su04webzoom-business[.]com

Analysis conducted on July 19, 2026 confirms that the domain su04webzoom-business.com is an active phishing site impersonating Zoom, a widely recognized video conferencing platform. The domain was registered through Ultahost, Inc. and currently resolves to the IP address 85.158.57.2, hosted under Datacamp Limited in Poland. Infrastructure analysis reveals the use of nameservers ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, and ns4.ultahost.com, consistent with the registrar's hosting environment. Security vendors have flagged this domain with moderate confidence: five out of ninety-one engines on VirusTotal detect it as malicious. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating prior identification as a threat. AlienVault OTX records the domain in one threat intelligence pulse, further corroborating its association with malicious activity. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and fraudulent sites, and does not inherently indicate trustworthiness. The site returns an HTTP 301 redirect, suggesting it may be part of a larger redirection chain or infrastructure designed to evade detection. The page title 'Index of /' indicates a directory listing, which is atypical for a legitimate Zoom service page and may reflect either misconfiguration or an attempt to obscure malicious content. No specific phishing kit or payload has been confirmed at this stage, and the exact content of the site remains unanalyzed. Defenders are advised to block the domain and its resolving IP address at the network level. Organizations using Zoom should alert employees to the risk of brand impersonation and reinforce verification procedures for communications claiming to originate from Zoom. Given the domain's active status and presence on multiple blocklists, continued monitoring is recommended to assess any shifts in infrastructure or tactics.