zoom-workplace-websession[.]online

The domain zoom-workplace-websession.online is a phishing site masquerading as a Zoom-related service. Despite being taken down, it is flagged by one out of 91 vendors on VirusTotal and is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. The site was hosted on Google Cloud infrastructure, with the IP address 34.111.179.208 located in the United States.

The page title, 'Oasis Elite Residence — Remote Access,' suggests an attempt to lure users into a false sense of security by implying a legitimate remote access service. The site was registered through HOSTINGER operations, UAB, and utilized a Let's Encrypt SSL certificate, which is common among phishing sites due to its free and automated issuance process. The domain's abuse score is relatively low at 16/100, indicating limited reporting or detection at the time of analysis.

Phishing domains like zoom-workplace-websession.online exploit the gap between domain registration and antivirus database updates, typically within a 24-72 hour window. This allows them to operate under the radar before being flagged by security vendors. PhishDestroy's proactive detection pipeline captures such threats in this critical period, providing early warnings to protect users and organizations from potential harm. The domain's swift takedown underscores the effectiveness of collaborative efforts in combating phishing threats.