us055webbzoomsecureconnetionj689975pwdkkchi[.]com

Analysis indicates that us055webbzoomsecureconnetionj689975pwdkkchi.com is a credential phishing domain targeting users with a likely focus on Zoom-related login credentials. The domain was registered on August 3, 2025, through Gransy, s.r.o., and is currently offline as of July 24, 2026. Infrastructure analysis reveals it resolved to the IP address 185.241.208.49, hosted on AS210558 (1337 Services GmbH) in Poland. The domain uses nameservers ns1.verifyhistoryreports.com and ns2.verifyhistoryreports.com, which may be part of a broader phishing infrastructure. Security vendor detections are present but limited: 13 of 95 vendors on VirusTotal flagged the domain as malicious, and it appears in one AlienVault OTX threat intelligence pulse.

The domain is also blocked by PhishDestroy and listed on at least one security blocklist. No SSL certificate was detected, increasing the likelihood of interception of unencrypted credentials. The page title 'Index of /' suggests either a misconfigured server or an attempt to evade automated detection by exposing directory listings rather than a polished phishing page. Technologies detected include Cloudflare and Cloudflare Browser Insights, which may have been used to obfuscate the true hosting origin or to monitor victim interactions. The absence of a valid SSL certificate and the use of Cloudflare do not align with legitimate service providers, particularly those handling authentication.

While the exact content of the phishing page is not confirmed, the domain name structure and available threat intelligence strongly suggest an intent to harvest Zoom credentials. Defenders should treat this domain as malicious and block it at the DNS and network levels. Organizations using Zoom should monitor for authentication attempts from this domain’s resolved IP and investigate any credentials submitted to it.