us05weboszoomworkspacemeeting-live-integratedinvite-2fxref[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation targeting Zoom, based on analysis conducted on July 12, 2026. The domain us05weboszoomworkspacemeeting-live-integratedinvite-2fxref.pages.dev was registered on August 22, 2025, through Cloudflare, Inc., and remains active with an HTTP 200 status. Its page title is 'Zoom Workspace Update', which is consistent with a brand impersonation campaign designed to deceive users into believing they are interacting with legitimate Zoom services. Infrastructure analysis reveals the domain is hosted on Cloudflare's network (AS13335) with nameservers kate.ns.cloudflare.com and carlos.ns.cloudflare.com, resolving to IP 172.66.47.26 located in the United States. Technologies detected include Tailwind CSS, HSTS, Cloudflare, and HTTP/3. The SSL certificate is issued by Google Trust Services. The domain appears on one security blocklist and is currently blocked by PhishDestroy. VirusTotal reports 1 detection out of 95 security vendors, confirming the domain is recognized as malicious by at least one scanning engine. The Gridinsoft trust score is 0/100, indicating strong suspicion of fraudulent activity. Defenders should treat this domain as actively hostile, block all traffic to it at the network or email gateway level, and monitor for any related subdomains or variations that may emerge. It is uncertain whether the domain hosts a fully functional login page or collects credentials, but the title and brand targeting strongly suggest credential theft or account takeover attempts. No additional threat kit or malware has been confirmed. Security teams should add this domain to their threat intelligence feeds and investigate any logs for attempted visits or credential submissions.