webexinvite[.]co

This domain, webexinvite.co, operates as a credential-harvesting phishing site targeting users of collaboration platforms. Analysis indicates the infrastructure mimics legitimate Webex meeting invitation pages, designed to deceive victims into entering corporate login credentials or personal information. The site employs social engineering tactics, such as urgent meeting requests or password reset prompts, to exploit human trust in enterprise communication tools. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on June 18, 2026, through NAMECHEAP INC, a registrar frequently associated with phishing campaigns. It resolves to IP address 72.11.149.223, hosted on AS36352 (HostPapa) in Canada, and is currently flagged by 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal detection rates show 1 out of 95 security vendors have classified this domain as malicious. The site uses a Let's Encrypt SSL certificate (YR1), providing a false sense of security to visitors. Users who have interacted with webexinvite.co should immediately revoke any entered credentials, particularly for corporate accounts or single sign-on (SSO) systems. Monitor associated accounts for unauthorized activity, including email forwarding rules or unusual login attempts. Network administrators should block the domain and its resolving IP (72.11.149.223) at the perimeter firewall level. If browser-based access occurred, clear cached data and run a full antivirus scan to detect potential secondary infections. Report the incident to internal security teams or relevant CERT organizations for further analysis and mitigation.