us018webzoom[.]com

Analysis of the domain us018webzoom.com indicates a recent brand‑impersonation campaign targeting Zoom users. The domain was created on 14 August 2025 and is hosted on Cloudflare’s network (ASN 13335) at IP address 172.67.141.219, which resolves to a United States location. The authoritative nameservers are henrik.ns.cloudflare.com and lana.ns.cloudflare.com, confirming the use of Cloudflare DNS services. No SSL certificate was observed, meaning the site operates over plain HTTP, a characteristic often seen in hastily deployed phishing infrastructure. The site’s page title, “Zoom Client Update,” aligns with the declared scam type of brand impersonation and matches the targeted brand “Zoom.” Registration details list OwnRegistrar, Inc. as the registrar, and the domain is currently listed as offline, suggesting that the malicious content has been taken down or the infrastructure has been disrupted.

Independent security blocklists have recorded the domain once, and the blocklist PhishDestroy is noted as having blocked it. Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely low reputation. VirusTotal analysis shows that six of ninety‑five scanning engines flagged the domain, providing additional corroboration of malicious intent. Despite these indicators, the limited number of vendor detections and a single blocklist entry imply that the campaign may have been short‑lived or low‑volume.

No further intelligence such as associated malware hashes, phishing kit identifiers, or command‑and‑control endpoints is available in the current dataset, leaving the full scope of the operation uncertain. Defenders should update URL filtering and DNS threat‑intelligence feeds to include us018webzoom.com, monitor for any re‑appearance of the domain or related Cloudflare IPs, and enforce strict TLS inspection policies to detect attempts to serve similar content over unencrypted channels.