us72webzoom[.]us

On July 23, 2026, security analysts observed that the domain us72webzoom.us was registered on December 18, 2025 through Dynadot LLC and is currently hosted on infrastructure owned by Beget LLC (ASN198610) in Russia, resolving to IP address 87.236.16.18. The domain is served via Nginx behind Cloudflare, presents a Let’s Encrypt R13 certificate, and returns an HTTP 403 status code for the default request. Technical fingerprinting identified the use of Lodash, jQuery (including the CDN version), FancyBox, and cdnjs libraries, indicating a typical web‑application stack often leveraged for credential‑harvesting pages. The authoritative nameservers are ns1.beget.com, ns1.beget.pro, ns2.beget.com, and ns2.beget.pro. The page title returned by the server reads “The new site has been successfully created and is ready to work,” providing no direct indication of malicious intent but matching patterns used in automated site‑creation kits.

The site is classified as a brand‑impersonation campaign targeting Telegram users. Threat intelligence sources have placed the domain on at least one security blocklist, and PhishDestroy has already blocked it. Gridinsoft’s trust scoring engine assigns a score of 0 out of 100, reflecting a high confidence in malicious behavior. VirusTotal analysis shows that 13 of 95 scanning engines flagged the domain, reinforcing the suspicion of abuse.

While the exact phishing page content has not been publicly disclosed, the combination of a low trust score, multiple vendor detections, active blocklist entries, and the explicit impersonation of Telegram constitute strong evidence of a high‑risk credential‑stealing operation. Defenders should immediately add us72webzoom.us to URL filtering and proxy blocklists, enforce TLS inspection to capture any encrypted traffic to the domain, and monitor DNS queries for the associated IP and nameserver patterns. Continuous re‑evaluation is advised, as the site remains active and could evolve its content or hosting.