us04webs[.]us

This domain, us04webs.us, was registered on 21 February 2026 through CNOBIN INFORMATION TECHNOLOGY LIMITED and is hosted on Cloudflare infrastructure (ASN 13335) at IP 170.114.78.80. No TLS certificate is presented, indicating that HTTPS connections would be rejected or downgraded to plain HTTP. The site resolves to the Cloudflare name servers arnold.ns.cloudflare.com and audrey.ns.cloudflare.com. The page title observed from the host is "One platform to connect | Zoom", which aligns with a brand‑impersonation campaign targeting Zoom users. The incident is classified as brand impersonation; the threat actor appears to be leveraging the Zoom brand to deceive victims.

VirusTotal has recorded detections from six of ninety‑five scanned security vendors, confirming that the domain is flagged by multiple AV engines. Independent threat‑intelligence feeds list the domain on three blocklists, including PhishDestroy, MetaMask and SEAL, and AlienVault OTX references it in one pulse. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The domain was taken offline prior to this analysis, and no active HTTP response was captured.

Consequently, the exact payload, credential‑harvesting form, or redirect chain remains unknown. Absence of an SSL certificate, combined with the low trust score and multiple vendor detections, suggests a high likelihood of phishing or credential‑stealing activity. Defenders should continue to block the domain at DNS and proxy layers, monitor traffic to the associated Cloudflare IP, and add the indicator set (domain, IP, registrar, and name‑server pair) to internal blocklists. Ongoing review of any residual DNS queries or connection attempts is recommended to catch delayed or re‑hosted infrastructure.