us05weboszoomworkspacevirtualagent-live-invitation-fx830[.]pages[.]dev

The domain us05weboszoomworkspacevirtualagent-live.pages.dev is actively engaged in brand impersonation targeting Zoom, a widely used video conferencing platform. This domain is currently classified as high-risk and remains operational, presenting a significant threat to users who may mistake it for legitimate Zoom services. The page title 'Zoom Workspace Update' reinforces the deception by mimicking official Zoom communication channels. Analysis indicates this domain was registered on August 18, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.125, which is associated with AS13335 (Cloudflare, Inc.) in the United States. It has been flagged by 1 of 95 security vendors on VirusTotal, and appears on a single security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, does not mitigate the malicious intent of the domain. Infrastructure analysis reveals the domain leverages Cloudflare’s hosting services, a common tactic to obscure origin servers and evade detection. The domain remains active as of the latest assessment, posing an ongoing risk of credential harvesting, malware distribution, or social engineering attacks. Organizations and users are advised to block this domain at the network level and implement strict email filtering to prevent delivery of messages containing this URL. Security teams should monitor for connections to 172.66.47.125 and review logs for any interactions with the domain. User awareness training should emphasize verifying domain authenticity before entering credentials or downloading software, particularly for communications claiming to be from Zoom or other high-profile brands.