ous05webwindowszoomworkspacemeeting-live-invitation-fx0xws[.]pages[.]dev

The domain ous05webwindowszoomworkspacemeeting-live-invitation-fx0xws.pages.dev impersonates the popular video conferencing platform Zoom. It was flagged by only 1 out of 93 vendors on VirusTotal, highlighting its potential to evade detection. The domain is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, indicating its malicious nature.

This phishing domain was hosted on an IP address registered to Cloudflare, Inc., located in the United States. It used an SSL certificate issued by Google Trust Services, which might lend an appearance of legitimacy to unsuspecting visitors. The page title "Zoom Workspace Update" suggests an attempt to deceive users into believing they are interacting with a legitimate Zoom service.

Despite being taken down, the domain's activity underscores the ongoing threat of brand impersonation scams. PhishDestroy's early detection on December 21, 2025, demonstrates the effectiveness of proactive monitoring in identifying threats before they are widely recognized by antivirus vendors. The low platform risk score of 10/100 suggests a targeted attack rather than a widespread campaign, but the potential for harm remains significant.

Phishing domains like this one exploit the critical window between domain registration and antivirus database updates, often a period of 24-72 hours. PhishDestroy's detection pipeline operates upstream of traditional AV vendors, capturing threats during this vulnerable phase. This case exemplifies the need for continuous vigilance and rapid response to emerging phishing threats.