ous05webzoomworkspace-live-reservationinvitation-fch0k9-8q[.]pages[.]dev

This domain has been flagged as a high-risk brand impersonation threat, specifically targeting Zoom users through a fake login page designed to steal credentials. The threat type is a classic phishing campaign that mimics Zoom's official workspace update interface, luring victims into entering sensitive information. PhishDestroy assesses this as an active and dangerous threat due to its convincing page title and the urgency implied by the update theme.

The domain resolves to IP 172.66.47.78 and was registered on May 21, 2025, through Cloudflare, Inc. Its SSL certificate is issued by Google Trust Services (WE1), which adds a false sense of legitimacy. VirusTotal shows only 1 out of 95 security vendors flagging this domain, indicating low detection rates among traditional scanners. However, it already appears on 3 security blocklists. The page title "Zoom Workspace Update" directly impersonates the brand, and the domain is hosted on a .pages.dev subdomain, a common free hosting service that attackers abuse for short-lived campaigns.

Users who encounter this domain should never enter any credentials or personal information. The safest mitigation is to avoid interacting with the page entirely. PhishDestroy recommends verifying any Zoom-related communications through official channels, such as directly visiting zoom.us or checking your account settings within the official Zoom app. If you have already submitted data, immediately change your Zoom password and enable two-factor authentication. Report the domain to Cloudflare and relevant cybersecurity authorities to help takedown efforts. Stay vigilant against similar lookalike domains that combine Zoom's name with random strings and free hosting platforms.