web-zoom[.]us

Analysis of web-zoom.us indicates a high‑risk brand‑impersonation campaign targeting Zoom. The domain resolves to IP 188.114.96.3, a Cloudflare, Inc. address located in Canada, and the HTTP response returns a 302 redirect. The site presents the page title "One platform to connect | Zoom," matching the legitimate Zoom brand, and the SSL certificate is issued by Let’s Encrypt (E8). Infrastructure fingerprints show use of OneTrust, HSTS, Google Tag Manager, Cloudflare and HTTP/3. The domain was registered on March 27, 2026 through Cloudflare, Inc., and its authoritative nameservers are davina.ns.cloudflare.com and johnathan.ns.cloudflare.com. Reputation metrics are poor: Gridinsoft assigns a trust score of 0/100, and four of ninety‑four VirusTotal scanners flag the domain. It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. While the page title confirms Zoom branding, the actual content beyond the title has not been publicly disclosed, leaving the exact phishing payload unknown. Defenders should treat web-zoom.us as malicious, enforce DNS or firewall deny rules, add the domain to internal blocklists, and monitor for related C2 infrastructure or similar Cloudflare‑hosted impersonation domains. Continuous threat‑intel feeds should be consulted for any updates to detection counts or observed malicious activity.