us06webs[.]us

The domain us06webs.us was registered on 21 February 2026 via CNOBIN INFORMATION TECHNOLOGY LIMITED and points to the IPv6 address 2407:30c0:183::aa72:4e50, which is announced by AS13335 Cloudflare, Inc. in the United States. The domain is configured to use Cloudflare’s authoritative nameservers justin.ns.cloudflare.com and margot.ns.cloudflare.com, but no TLS certificate is present, indicating the site was served without HTTPS. As of the report date the host is taken offline, and there is no active HTTP response to probe further. Threat intelligence flags the site as a brand‑impersonation campaign; the page title returned from the server is “One platform to connect | Zoom”, suggesting an attempt to lure victims under the Zoom brand.

VirusTotal scans show four of ninety‑three security vendors flag the domain as malicious, and the domain appears on three public blocklists. Additional protective products have listed the domain as blocked, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The available data confirms the infrastructure is hosted behind Cloudflare, a common choice for fast‑flux or anonymised phishing infrastructure, and the lack of TLS further reduces credibility.

Uncertainty remains regarding the exact phishing kit or payload because no page content has been captured and the site is offline. Defenders should add us06webs.us to blocklists at the network perimeter, update DNS sinkhole entries, and monitor for any related sub‑domains or new domains registered by the same registrar. Continuous re‑scanning with VirusTotal and other multi‑engine platforms is advised to capture any future changes, and any traffic to the associated IPv6 address should be logged and investigated for potential credential harvesting attempts.