1zoomspaceonwbr[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting users of a widely recognized video conferencing platform. The site mimics legitimate branding, including the page title 'One platform to connect | Zoom,' to deceive visitors into disclosing credentials or installing malicious payloads. Analysis indicates the domain is specifically designed to exploit trust in the targeted brand, likely for credential harvesting or malware distribution. Infrastructure analysis reveals the domain was registered on September 02, 2020, through Cloudflare, Inc., and resolves to the IP address 170.114.78.80, hosted under AS209242 (Cloudflare London, LLC). The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 1 of 95 security vendors on VirusTotal. No SSL certificate is present, increasing the likelihood of interception or manipulation of transmitted data. The domain remains active, posing an ongoing risk to users. Mitigation steps should include immediate blocking of the domain and its resolving IP address across network security controls. Organizations should deploy email and web filtering rules to prevent delivery or access to URLs containing '1zoomspaceonwbr.pages.dev.' End-user awareness training should emphasize verifying domain authenticity before entering credentials, particularly for platforms commonly targeted by impersonation campaigns. Security teams are advised to monitor for related indicators, such as similar subdomains under 'pages.dev' or newly registered domains mimicking the targeted brand.