private05webzoomworkspacemeeting-live-invite-us05web83517x[.]pages[.]dev

This domain is flagged for high-risk brand impersonation targeting Zoom users through a deceptive workspace update page. Analysis indicates the site mimics legitimate Zoom communications, likely aiming to harvest credentials or distribute malicious payloads under the guise of a required software update. The page title, 'Zoom Workspace Update,' reinforces the illusion of authenticity, increasing the likelihood of user engagement. Infrastructure analysis reveals the domain was registered on September 2, 2020, through Cloudflare, Inc., and resolves to the IP address 172.66.47.77, hosted on AS13335 (Cloudflare, Inc.). VirusTotal detection shows 1 out of 95 security vendors have flagged this domain, while it appears on 3 distinct security blocklists, including PhishDestroy and SEAL. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to evade initial suspicion. The domain remains active as of the latest verification. Users who have visited this domain should immediately terminate any active sessions and revoke access to any linked accounts. Credentials entered on the site must be considered compromised and changed from a secure device. Network-level blocking of the domain (private05webzoomworkspacemeeting-live-invite-us05web83517x.pages.dev) and its resolving IP (172.66.47.77) is recommended. Organizations should audit logs for connections to this infrastructure and monitor for anomalous authentication attempts or unauthorized software installations originating from the same timeframe as the exposure.