uv01webzoom[.]us

This domain is flagged as a credential harvesting scam designed to mimic legitimate video conferencing platforms, likely targeting users through deceptive login portals. Analysis indicates the infrastructure is engineered to capture authentication details, including usernames, passwords, and potentially multi-factor authentication codes, which are then exfiltrated to attacker-controlled servers. The domain employs social engineering tactics, such as fake meeting invitations or account verification prompts, to trick victims into disclosing sensitive information. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain uv01webzoom.us was registered on February 21, 2026, an unusually future-dated creation that aligns with known phishing campaign patterns. It resolves to the IP address 83.136.211.187, hosted on AS400897 (PETROSKY CLOUD LLC) in France, a provider frequently associated with malicious activity. The domain appears on 3 security blocklists, including entries from enterprise-grade threat intelligence feeds, and is flagged by 19 out of 95 security vendors on VirusTotal. Additionally, the SSL certificate (R13) lacks organizational validation, a common characteristic of phishing sites attempting to appear legitimate while avoiding scrutiny. Users who visited uv01webzoom.us should immediately revoke any credentials entered on the site, particularly those associated with video conferencing, email, or single-sign-on services. Monitor accounts for unauthorized access, including suspicious login attempts or changes to account settings. If financial or corporate systems were accessed via this domain, initiate incident response protocols, including password resets and multi-factor authentication reviews. Network administrators should block the domain and its associated IP (83.136.211.187) at the firewall level to prevent further exposure. Given the domain’s current offline status, victims should remain vigilant for follow-up attacks, such as phishing emails or malware distribution, leveraging stolen credentials.