us05portalwebzoomworksmeeting-live-invitation-iz-update[.]pages[.]dev

Analysis of the domain us05portalwebzoomworksmeeting-live-invitation-iz-update.pages.dev, observed on July 25 2026, indicates that it is being used for credential phishing, specifically classified as banking phishing. The site is hosted behind Cloudflare’s network (ASN 13335) and resolves to the IP address 172.66.47.155, which is located in the United States. Cloudflare services are confirmed by the presence of HSTS and HTTP/3 support, and the TLS certificate is issued by Google Trust Services under the WE1 root, suggesting a legitimate‑looking HTTPS connection. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, consistent with a blocked or taken‑offline page.

The domain was created on 2 September 2020 and is registered through Cloudflare, Inc.; its authoritative nameservers include adi.ns.cloudflare.com, giancarlo.ns.cloudflare.com, karl.ns.cloudflare.com, and melissa. Reputation checks show a Gridinsoft trust score of 0 / 100 and a detection by two of ninety‑three VirusTotal scanners, while it appears on a single external blocklist and has been flagged by PhishDestroy. The limited detection count and single blocklist entry suggest that the malicious activity may be recent or low‑volume, but the presence of a banking phishing classification and the low trust score warrant elevated risk.

Defenders should immediately block the fully qualified domain name and its underlying IP address at perimeter and DNS layers, ensure that any outbound connections to Cloudflare‑served pages are inspected, and monitor for re‑use of the domain or similar sub‑domains. Continuous threat‑intel feeds should be consulted for any future re‑registration, and endpoint protection policies should be updated to treat any credentials entered on pages presenting the “Suspected phishing site | Cloudflare” title as compromised.