ous05webdesktopzoomworkspace-live-invite-reservation6024-8[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Zoom users through a fraudulent workspace update page. The specific threat involves credential harvesting via a spoofed login interface, leveraging the legitimate appearance of Zoom's branding to deceive victims into entering authentication details. The page title, 'Zoom Workspace Update,' aligns with common social engineering tactics used to exploit trust in software updates and workspace invitations. Analysis indicates the domain ous05webdesktopzoomworkspace-live-invite-reservation6024-8.pages.dev was registered on July 23, 2025, through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), adding a layer of perceived legitimacy. VirusTotal reports 2 out of 95 security vendors have flagged this domain as malicious, while it appears on one security blocklist. Despite these detections, the domain remains active and unmitigated at the time of assessment. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP (188.114.97.3) at the network perimeter. Organizations should deploy email and web filtering rules to prevent user access to the domain, particularly for messages containing workspace or update-related lures. End-user awareness training should emphasize the risks of unsolicited workspace invitations or update prompts, especially those redirecting to non-Zoom domains. Security teams are advised to monitor for credential reuse attempts following exposure to this domain, as harvested credentials may be leveraged in subsequent attacks. Additionally, Zoom users should be instructed to verify the authenticity of workspace invitations by cross-referencing sender domains and inspecting URLs for anomalies prior to interaction.