Phishing detection: support.zoom.us.mamahputri.kasifa.de5.net

Zoom
https://support.zoom.us.mamahputri.kasifa.de5.net Access site
Screenshot
Screenshot of support.zoom.us.mamahputri.kasifa.de5.net
Investigate
Domain support.zoom.us.mamahputri.kasifa.de5.net
urlscan page.domain VirusTotal Whois
IP 172.66.44.243
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://support.zoom.us.mamahputri.kasifa.de5.net
urlscan Wayback archive.today
Cert WE1
crt.sh Censys Google CT
Phishunt analysis Beta
75 high suspicion likely_phishingheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +4.1 Brand in screenshot
  • +3.9 Password field
  • +2.6 Brand in subdomain
  • +1.3 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.9 Young certificate
  • +0.8 Brand + login token
  • +0.7 Brand in cert SAN
  • +0.7 Brand typo
  • +0.7 Unrecognised DNS provider
  • +0.6 Long domain
  • +0.6 Registrar reputation
  • +0.6 Script exfil endpoint
  • +0.6 Deep subdomain
  • +0.3 Free CA
  • +0.2 Suspicious TLD
  • +0.1 External scripts
  • Boosted to 75: Credential exfil kit
22 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Impersonates Zoom support via a deep subdomain chain ending in an unrelated de5.net domain behind Cloudflare. The page has a password input and a script sending data to an exfiltration endpoint, consistent with credential theft.

Password fieldScript exfil endpointBrand + login token
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-29 · confidence 85%
Domain & Network
Whois
Registrar Spaceship, Inc.
Network
IP 172.66.44.243 Cloudflare CDN
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert WE1
External detection No external source flags this
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed · urlscan.io
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-29 17:26 UTC  ·  Last refreshed 2026-10-23 05:30 UTC