zoomworkplace-connect[.]com

Analysis of zoomworkplace-connect.com indicates that the domain was registered on February 27 2026 through OwnRegistrar, Inc. The site resolves to the IPv4 address 65.181.111.226, which is announced by AS14670 WHG Hosting Services Ltd and geolocated to the United States. No TLS certificate is presented, meaning the site is served over plain HTTP. The page title returned by the web server is “Zoom Workplace: Team Collaboration Tools | Zoom”, suggesting that the content attempts to reference the Zoom brand, although the page body has not been examined. VirusTotal reports that one of ninety‑three scanning engines flagged the domain, and the domain appears on three public security blocklists.

Additionally, it is listed as blocked by the PhishDestroy, MetaMask, and SEAL filters. The authoritative nameservers are ns1.mysecurecloudhost.com, ns2.mysecurecloudhost.com, ns3.mysecurecloudhost.com, and a fourth entry truncated as “ns”. The current operational status is offline, indicating that the site has been taken down or is otherwise inaccessible. The available evidence supports classification of the domain as a generic phishing infrastructure targeting Zoom users, but the exact phishing kit, credential‑harvesting method, and any associated payloads remain unknown.

No SSL/TLS configuration, no observed redirects, and no content analysis limit the ability to assess the full attack vector. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed blocklist entries, and monitor for any future re‑hosting of the same host name or IP address. Threat‑intel teams should also track the registrar and nameserver patterns for potential reuse in related campaigns, and consider sharing the indicator set with industry‑wide platforms to improve collective detection.