zoomwebinvite[.]us

PhishDestroy identifies zoomwebinvite.us as an active generic phishing domain posing as a fake Zoom webinar invitation. The primary threat is credential harvesting through deceptive login pages designed to trick users into entering corporate or personal account credentials under the pretense of joining a meeting. This domain was flagged due to its recent registration, rapid deployment for luring victims via social engineering, and lack of detection in early sandbox scans despite high-risk behavioral patterns. This domain was registered through NameSilo, LLC on May 18, 2025, and resolves to IP address 188.114.96.3. It currently hosts a valid SSL certificate issued by Google Trust Services, which is often abused by threat actors to add a false sense of legitimacy. VirusTotal shows 0 detections out of 95 engines, indicating it has not yet been widely flagged. The domain’s age, coupled with the use of a reputable certificate authority, suggests an emerging campaign likely leveraging urgency (e.g., “Join this urgent Zoom meeting”) to bypass traditional spam filters and user skepticism. Mitigation steps for this threat include avoiding any links or attachments from unsolicited meeting invites, especially those from domains not matching the official zoom.com or zoom.us structure. Users should verify meeting URLs by manually entering known domains or contacting the organizer through a trusted communication channel. Organizations are advised to deploy URL reputation filtering, block traffic to 188.114.96.3 at the network perimeter, and educate employees on the risks of credential phishing via fake conferencing platforms. Immediate reporting of suspicious domains to IT security teams and abuse channels (e.g., abuse@namesilo.com, Google Trust Services) is critical to accelerate takedown and prevent wider victimization.