business-05webzoom[.]com

On July 19 2026 the domain business-05webzoom.com was observed hosting a brand-impersonation campaign targeting Zoom. The site returned HTTP 200 with the page title "Index of /", indicating a directory listing rather than a crafted login portal. The host resolves to IP 85.158.57.2, an address registered to Datacamp Limited in Poland. DNS resolution uses four authoritative name servers (ns1-ultahost.com, ns2-ultahost.com, ns3-ultahost.com, ns4-ultahost.com) and the domain was registered through Ultahost, Inc. The TLS certificate is issued by Let’s Encrypt (YR1), confirming the presence of HTTPS. Email services point to a self-referencing MX record (priority 0) pointing back to business-05webzoom.com, a pattern often seen in malicious infrastructure. Seven of ninety-one VirusTotal scanners flagged the domain, and three independent blocklists presently list it, leading to its current offline status. The domain is blocked by PhishDestroy, MetaMask, and SEAL. Although the exact payload or credential‑harvesting page has not been captured, the combination of brand impersonation labeling, the Zoom target, and the observed infrastructure strongly suggests a phishing operation. Defensive actions should include adding the domain and its resolving IP to blocklists, monitoring DNS queries for the associated name servers, and reviewing any outbound connections to 85.158.57.2. Organizations using Zoom credentials should be reminded to verify URL authenticity and to treat any unsolicited communications directing to this host as malicious.