us007-webzoom[.]us

This domain, us007-webzoom.us, is actively engaged in credential theft phishing operations, designed to harvest login credentials, session tokens, or other sensitive authentication data from unsuspecting users. The infrastructure mimics legitimate web services or corporate login portals, leveraging social engineering tactics to deceive visitors into entering their credentials. Analysis indicates the domain is likely part of a broader campaign targeting enterprise or consumer accounts, with potential secondary objectives including account takeover or lateral movement within compromised environments. Infrastructure analysis reveals the domain was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.2.25, hosted on AS13335 Cloudflare, Inc., a common obfuscation tactic to conceal the true origin of the malicious activity. The domain appears on three independent security blocklists, and VirusTotal detection shows 1 out of 95 security vendors flagging it as malicious. The SSL certificate, issued by Google Trust Services (WE1), further indicates an attempt to appear legitimate while maintaining operational security. Users who have interacted with us007-webzoom.us should immediately revoke any entered credentials, particularly if reused across other platforms. Monitor accounts for unauthorized access or transactions and enable multi-factor authentication where available. Network administrators are advised to block the domain and its associated IP address (104.21.2.25) at the perimeter. If session tokens or cookies were exposed, clear browser data and rotate all active sessions. Organizations should conduct a review of logs for connections to the domain or IP to identify potential compromise.