lwebzoomworkspacemeeting-live-invitation-iz-3o8[.]pages[.]dev

lwebzoomworkspacemeeting-live-invitation-iz-3o8.pages.dev was observed hosting a brand‑impersonation page that claimed to represent Zoom. The site was registered on 02 May 2025 through Cloudflare, Inc. and resolves to the Cloudflare edge IP 172.66.47.85, located in the United States under ASN 13335. DNS resolution uses the Cloudflare authoritative name servers elliott.ns.cloudflare.com and stevie.ns.cloudflare.com, and the HTTPS service is backed by a Google Trust Services / WE1 certificate, indicating a valid TLS chain but also providing the attacker with a trusted certificate. The HTTP response returned a 403 status code, suggesting that direct access to the landing page is now blocked. Security‑vendor scanning on VirusTotal recorded seven positive detections out of ninety‑three scanners, and the domain appears on a single external blocklist.

The page title returned by the server is simply “Zoom,” matching the advertised brand target. Additional analysis reported the presence of HSTS, Cloudflare’s protective services, and HTTP/3 support, all typical of legitimate Cloudflare‑hosted sites and therefore not indicative of malicious code by themselves. The Gridinsoft trust score of 0 / 100 further confirms that the host is considered highly untrustworthy. PhishDestroy has taken the site offline, and the current status is flagged as offline. The available evidence clearly shows that the infrastructure was designed to mimic Zoom communications in order to harvest banking credentials, as indicated by the “Banking Phishing” scam type.

However, the exact phishing workflow, form fields, or payloads have not been publicly released, leaving the internal mechanics uncertain. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the associated Cloudflare name servers, and add the IP address 172.66.47.85 to reputation lists.