us04webzoom-meeting[.]com

PhishDestroy identifies us04webzoom-meeting.com as a credential theft domain mimicking legitimate Zoom meetings. The page is likely harvesting login credentials under the guise of a required ‘meeting access’ form, a common tactic for account takeover. No drainer kit artifacts were observed in passive scans, but the domain’s structure and lack of legitimate Zoom branding controls strongly suggest active impersonation aimed at harvesting credentials for further exploitation.

Technical indicators reveal 0 detections out of 95 engines on VirusTotal, a Cloudflare-registered domain resolving to IP 188.114.96.3, and a Google Trust Services SSL certificate covering the current session. The domain was created on May 05, 2026—an unusually recent timestamp indicating opportunistic registration targeting current events or ongoing campaigns. As of this assessment, no presence on Google Safe Browsing (GSB) blocklists has been confirmed.

This domain remains active and under investigation, with current risk classified as elevated due to active credential theft intent. Users are advised to avoid interaction and report the domain to their security teams. Remaining risk includes potential escalation to widespread phishing campaigns leveraging compromised credentials. Immediate blocking at network and endpoint levels is recommended to prevent data exposure.