web22n[.]us

Analysis of web22n.us, reported on July 24, 2026, indicates that the domain is engaged in a generic phishing campaign targeting Zoom users. The domain was registered through NameSilo, LLC on March 06, 2026 and resolves to the IP address 68.65.121.244, which belongs to AS22612 Namecheap, Inc. in the United States. No SSL certificate is present, meaning all traffic would be unencrypted, a typical characteristic of low‑cost phishing infrastructure. The authoritative nameservers are dns1.namecheaphosting.com and dns2.namecheaphosting.com, both associated with Namecheap hosting services.

The page title returned from the live site, "One platform to connect | Zoom," directly references Zoom’s branding, suggesting the site was designed to lure Zoom users into providing credentials or personal information. The domain is currently taken offline, but historical evidence shows it was blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists. VirusTotal scans recorded a single positive detection out of ninety‑four security vendors, confirming at least one scanner flagged the domain as malicious.

While the exact content served by the site has not been captured and HTTP response codes are unavailable, the combination of brand‑spoofing page title, lack of TLS, and presence on reputable phishing blocklists provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of activity, and consider adding the IP address to threat‑intelligence feeds. Further investigation, such as retrieving archived page snapshots or conducting sandbox analysis of any downloaded payloads, would be required to fully characterize the phishing payload and confirm the exact attack vector.