us05portalwebzoomworkspacemeeting-live-invitation-iz-3o7x[.]pages[.]dev

The domain us05portalwebzoomworkspacemeeting-live-invitation-iz-3o7x.pages.dev is engaged in a high-risk brand impersonation campaign targeting Zoom. The page title, "Zoom Client Update - Zoom Meetings," is designed to trick users into believing they are visiting an official Zoom update portal. No specific drainer kit has been identified, but the threat type is clear: credential theft or malware delivery through a fake update page.

Technical indicators paint a concerning picture. VirusTotal reports a detection ratio of 3 out of 95 security vendors flagging this domain as malicious. The domain was registered through Cloudflare, Inc. and resolves to IP address 188.114.97.3. It was created on April 23, 2025, and is currently still active. The SSL certificate is issued by Google Trust Services (WE1). The domain appears on three security blocklists, indicating it has been recognized by multiple threat intelligence sources.

As of the latest analysis, the domain remains active and responsive, posing an ongoing risk to Zoom users who may encounter it via phishing emails, social media, or search engine results. While it has been flagged by some security vendors and blocklists, the low detection rate (3/95) means many users may not be protected by their security tools. Users are advised to avoid interacting with this domain, never enter credentials or download files from it, and report any sightings to their security team. PhishDestroy recommends blocking the domain at the network level and conducting user awareness training on fake update pages.