ous05webzoomworkspacereseration-live-invite-fx1074s98f0[.]pages[.]dev

The domain ous05webzoomworkspacereseration-live.pages.dev is actively engaged in brand impersonation targeting Zoom, a widely used video conferencing platform. This threat is classified as credential theft, designed to deceive users into disclosing sensitive login information under the guise of a legitimate Zoom service. As of the latest verification, the domain remains operational and unmitigated. Analysis indicates the domain was registered on July 20, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted on Cloudflare’s infrastructure (AS13335). Security vendors have flagged this domain in 1 of 95 VirusTotal scans, and it appears on a single security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious actors to lend an appearance of legitimacy. The page title, 'Zoom Workspace Update,' reinforces the impersonation by mimicking official Zoom communications, increasing the likelihood of user deception. Infrastructure analysis reveals that the domain leverages Cloudflare’s content delivery network, which can obscure the true origin of the threat and complicate takedown efforts. The low detection rate on VirusTotal suggests the campaign may still be in its early stages or employing evasion techniques. Organizations and users are advised to block the domain at the network level, update endpoint protection rules to include this indicator of compromise, and conduct internal awareness training to recognize brand impersonation tactics. Monitoring for similar domains using the 'zoomworkspacereseration' or 'live-invite' naming patterns is recommended to preempt further attacks.