us71web[.]us

This domain, us71web.us, is flagged for brand impersonation targeting Zoom, a widely used video conferencing platform. Analysis indicates the site presented a fraudulent "Launch Meeting - Zoom" page, designed to deceive users into entering login credentials or installing malicious software under the guise of joining a legitimate meeting. The threat type aligns with credential harvesting campaigns, which often exploit corporate trust in remote collaboration tools to bypass security awareness controls. Infrastructure analysis reveals the domain was registered through DYNADOT LLC on February 21, 2026, and resolved to the IP address 2.56.179.135. Detection metrics show 4 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100, indicating high confidence in its malicious nature. The domain appears on three security blocklists and is actively blocked by MetaMask, SEAL, and PhishDestroy, suggesting cross-industry recognition of its fraudulent intent. No association with known drainer kits or cryptocurrency wallet theft was observed in this instance. As of the latest assessment, us71web.us has been taken offline, likely in response to abuse reports or registrar enforcement actions. However, the elevated risk persists due to the domain's recent creation date and the registrar's historical association with abusive registrations. Organizations are advised to monitor for residual redirects or DNS cache persistence, particularly in environments where Zoom is a critical business tool. Users should verify meeting URLs against official Zoom domains and enable multi-factor authentication to mitigate credential theft risks. The domain's infrastructure and detection profile warrant continued vigilance for potential resurgence under similar naming conventions.