uswebmeetingzoom02[.]pages[.]dev

This domain, uswebmeetingzoom02.pages.dev, is flagged as a high-risk brand impersonation threat targeting Zoom users. The page title, 'Join Meeting | Zoom,' mimics legitimate Zoom meeting portals, suggesting an intent to deceive users into entering credentials or downloading malicious payloads. No direct evidence of a crypto drainer kit is present, but the infrastructure aligns with credential theft campaigns. The domain leverages Zoom's branding to exploit trust in remote collaboration tools, a common tactic in targeted phishing operations. Analysis indicates the domain was registered on February 23, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Let's Encrypt (serial E7), a frequent choice for malicious domains due to its low-cost and automated issuance. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious. The domain appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. Google Safe Browsing (GSB) status is not explicitly provided, but the blocklist presence suggests it is likely categorized as unsafe. The domain remains active as of this report, posing an ongoing risk to users. Response actions should include immediate blocking of the domain and IP at the network perimeter, as well as monitoring for related infrastructure (e.g., subdomains, sibling IPs). Users are advised to verify Zoom meeting links via official channels and avoid entering credentials on unsolicited pages. The high-risk classification is justified by the domain's active status, brand impersonation, and partial detection by security vendors, despite the low VirusTotal score. Continuous monitoring is recommended to track potential shifts in tactics or infrastructure.