us52web[.]us

This domain, us52web.us, is flagged as a generic phishing site targeting users of the Zoom video conferencing platform. Analysis of the page title, 'One platform to connect | Zoom,' indicates an attempt to deceive victims into entering credentials by mimicking the official Zoom login interface. No specific drainer kit signatures were identified in initial scans, but the domain exhibits characteristics consistent with credential harvesting infrastructure. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 64.29.17.1 and was registered on April 17, 2026, through Web Commerce Communications Limited dba WebNic.cc. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged. However, it appears on 3 security blocklists and is referenced in 1 AlienVault OTX threat intelligence pulse. Detected technologies include OneTrust, HSTS, Google Tag Manager, Cloudflare, and HTTP/3, which may be used to obfuscate malicious activity or enhance the site's perceived legitimacy. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. Despite its inactive status, residual risk remains due to the potential for re-registration or migration to a new host. Organizations are advised to block the domain and its associated IP (64.29.17.1) at the perimeter, monitor for credential reuse attempts, and alert users who may have interacted with the site prior to takedown. Continuous monitoring of related infrastructure is recommended, as threat actors frequently re-deploy phishing campaigns using similar domains or IPs.