us05webs[.]com

us05webs.com was observed on July 25, 2026 delivering a generic phishing campaign that mimics Zoom, as indicated by the page title “One platform to connect | Zoom”. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare infrastructure (ASN 13335). DNS resolution points to IP address 188.114.97.3, which is geolocated to the United States and is associated with Cloudflare’s edge network. No SSL certificate was presented during the scan, meaning the site served over plain HTTP.

VirusTotal analysis recorded four detections out of ninety‑three security vendors, confirming that multiple scanners have identified malicious behavior. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing vector. Nameserver configuration uses Cloudflare’s authoritative servers kallie.ns.cloudflare.com and steven.ns.cloudflare.com, a common pattern for fast‑flux or abuse‑friendly domains. The site was taken offline at the time of reporting, and no further HTTP response details are available.

While the page title suggests an attempt to impersonate Zoom, the actual content of the landing page has not been captured, leaving the precise credential‑harvesting technique uncertain. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP and nameservers, and add the domain to internal threat‑intel feeds. Additional harvesting of payloads or redirects should be pursued if the site resurfaces, and any credentials submitted to the URL should be treated as compromised. Ongoing observation of the hosting provider and registrar may reveal further related infrastructure.