ous05weboszoomworkspaceresolve-live-fx1074s98fd[.]pages[.]dev

This domain is flagged as a high-risk phishing site designed to harvest Zoom account credentials. The page mimics a legitimate Zoom Workspace update notification, tricking users into entering login details on a fraudulent interface. Attackers may use these credentials to access corporate meetings, sensitive communications, or deploy further malware within an organization. Analysis indicates the domain was registered on August 20, 2025, through Cloudflare, Inc. infrastructure. It currently resolves to the IP address 188.114.97.3, hosted in Canada under Cloudflare’s network. VirusTotal reports 1 out of 95 security vendors have flagged this domain as malicious, and it appears on one security blocklist. The page title, 'Zoom Workspace Update,' is a direct attempt to deceive users familiar with Zoom’s branding and update prompts. If you or someone in your organization visited this domain, immediately reset any entered credentials through Zoom’s official password recovery page. Check for unauthorized access in Zoom account settings, including linked devices or recent meeting activity. Enable multi-factor authentication on all accounts to prevent future credential-based attacks. Monitor network logs for connections to 188.114.97.3 or the domain ous05weboszoomworkspaceresolve-live-fx1074s9.pages.dev, as these may indicate compromised systems. Report the incident to your internal security team for further investigation.