onwebmeet[.]us

This domain, onwebmeet.us, is under investigation for hosting a generic phishing scheme designed to mimic legitimate video conferencing platforms. Analysis indicates the site presents fraudulent login interfaces to harvest user credentials, potentially enabling unauthorized access to corporate or personal accounts. The threat does not appear to be a crypto drainer or brand-specific impersonation but rather a broad credential theft operation targeting remote collaboration tools. Infrastructure analysis reveals the domain was registered on June 25, 2026, through NAMECHEAP INC, a registrar frequently utilized for both legitimate and malicious purposes. As of the latest assessment, the domain resolves to the IP address 198.187.31.85 and has not been flagged by any of the 95 security engines on VirusTotal. The SSL certificate, issued by Sectigo Limited, provides a false sense of security while failing to mitigate the underlying phishing risk. No blocklist entries or prior abuse reports were identified, suggesting the campaign may still be in its early stages. Users who have visited onwebmeet.us or entered credentials on the site should immediately reset passwords for any accounts accessed through the domain. Multi-factor authentication should be enabled on all critical services to prevent unauthorized logins. Network administrators are advised to block the domain and its associated IP address (198.187.31.85) at the perimeter level. Monitoring for unusual login attempts or data exfiltration patterns is recommended, particularly for organizations that rely on video conferencing platforms. If financial or sensitive information was submitted, affected parties should report the incident to relevant authorities and consider credit monitoring services.