us05web-zoom-invitation-liveworkspace86543signupur[.]pages[.]dev

This domain presents a high-risk brand_impersonation threat. Analysis indicates infrastructure designed to mimic a trusted brand identity and display the page title "Zoom Workspace Update" in order to increase credibility and potentially induce user interaction, credential submission, or other unauthorized actions. Its active status increases exposure risk because the content remains reachable and capable of targeting visitors.

Infrastructure analysis reveals that the domain was created on September 02, 2020 and is registered through Cloudflare, Inc. Resolution data maps the domain to IP address 172.66.44.86, located in the US under AS13335 Cloudflare, Inc. Certificate information shows Google Trust Services / WE1. Detection telemetry indicates that 6 out of 95 security vendors flag the domain, and it appears on 3 security blocklists. Current intelligence confirms that it remains active. Blocking records specifically indicate inclusion by PhishDestroy, MetaMask, and SEAL. These indicators collectively support classification as a high-risk brand impersonation asset despite mixed detection coverage across security engines.

Recommended mitigation focuses on impersonation-based social engineering risks. Organizations should block access to the domain and associated indicators at network, DNS, email, and web-filtering layers. Security teams should monitor authentication logs for unusual sign-in attempts, investigate potential credential exposure linked to visits, and alert users to verify website identities before entering sensitive information. Any communications referencing the impersonated brand should be validated through trusted channels. Continuous monitoring for related domains, matching page titles, certificate reuse, and overlapping infrastructure can help identify additional assets connected to the same campaign.