us05webosportalzoomworkspacemeeting-live-invitation-m90x76[.]pages[.]dev

The domain us05webosportalzoomworkspacemeeting-live-invitation-m90x76.pages.dev is currently engaged in a high-risk brand impersonation campaign targeting Zoom, a widely used video conferencing platform. Analysis of the page title, 'Zoom Client Update - Zoom Meetings,' confirms the intent to deceive users into believing they are interacting with legitimate Zoom software updates or meeting invitations. This domain remains active as of the latest verification, posing a significant threat to end-users who may unknowingly disclose credentials or install malicious payloads. Infrastructure analysis reveals the domain was registered on April 24, 2025, through Cloudflare, Inc., a registrar frequently leveraged for its privacy and content delivery services. The domain resolves to the IP address 172.66.47.42, associated with AS13335 (Cloudflare, Inc.) and geolocated in the United States. Detection metrics indicate minimal initial coverage, with only 1 of 95 security vendors on VirusTotal flagging the domain at the time of assessment. Additionally, the domain appears on a single security blocklist, suggesting limited visibility within the threat intelligence community. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but does not mitigate the underlying malicious intent. Current status confirms the domain remains operational, continuing to host content designed to impersonate Zoom’s official client update process. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include the identified IP address. Users should be educated to verify the authenticity of software update prompts by cross-referencing with official vendor communications. Given the low initial detection rate, proactive monitoring of related infrastructure and retrospective analysis of logs for connections to 172.66.47.42 is recommended to identify potential prior compromises.