ous05webzoommeetingworkspaceapplication080328-837421xlive[.]pages[.]dev

The domain ous05webzoommeetingworkspaceapplication080328-837421xlive.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Zoom users. It presents itself as a legitimate Zoom workspace update page but is designed to harvest login credentials through credential phishing. No crypto drainer kit was identified. The site is currently taken offline, though it was active during its operational window.

Technical analysis shows ous05webzoommeetingworkspaceapplication080328-837421xlive.pages.dev was registered through Cloudflare, Inc. on June 11, 2025, and resolved to the IP address 172.66.46.247, hosted on Cloudflare's US infrastructure (AS13335). At the time of assessment, 0 of 95 VirusTotal vendors flagged the domain, and Google Safe Browsing did not detect it. The domain appeared on 1 security blocklist (PhishDestroy). The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Zoom Workspace Update'. Technologies detected include HSTS, Cloudflare, and HTTP/3. The site returned an HTTP 403 status when last checked.

Victims who interacted with ous05webzoommeetingworkspaceapplication080328-837421xlive.pages.dev should immediately change their Zoom passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or changes. Report the phishing domain to Zoom's security team via their official abuse reporting channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.