w04z[.]us

This domain is a credential theft operation impersonating Zoom, a widely used video conferencing platform. Analysis indicates the site mimics legitimate Zoom login and account management pages to harvest user credentials, including email addresses and passwords. The infrastructure is designed to deceive users into entering sensitive information under the guise of accessing Zoom services, which can lead to unauthorized account access, data breaches, or further targeted attacks. Evidence supporting this assessment includes 16 out of 95 security vendors flagging the domain on VirusTotal, with detections spanning phishing, fraud, and malicious activity categories. The domain was registered on March 23, 2026, through NameSilo, LLC, an uncommon registrar for legitimate corporate domains. Infrastructure analysis reveals it appears on three security blocklists, including MetaMask and PhishDestroy, and resolves to the IP address 68.65.121.244. Technologies detected on the site include Cloudflare, HSTS, and Google Tag Manager, which are often leveraged to obfuscate malicious activity and enhance the site's perceived legitimacy. Users who visited w04z.us or entered credentials on the site should immediately change their Zoom password and enable multi-factor authentication if available. Monitor accounts for unauthorized activity, such as unexpected meetings, contacts, or changes to account settings. If financial or sensitive data was entered, consider reporting the incident to relevant authorities and credit monitoring services. Block the domain and IP address 68.65.121.244 in network security tools to prevent further exposure. Organizations should update endpoint protection and email filtering rules to detect and block similar impersonation attempts.