z[.]gettrustpayment[.]live

PhishDestroy identifies z.gettrustpayment.live as an active fake payment portal phishing site currently under investigation by cybersecurity analysts. This domain impersonates a trustworthy payment service to harvest financial credentials from unsuspecting users. The threat type has been classified as generic_phishing, with a current risk level labeled as under_investigation and a status of active. No specific brand or drainer kit has been confirmed at this stage, though the domain’s naming suggests a fake payment verification portal designed to mislead victims into entering sensitive data. This domain resolves to IP address 185.246.190.216 and is secured with a Let’s Encrypt SSL certificate, which may assist in bypassing security warnings in some browsers. As of the last scan, VirusTotal registered 0 detections out of 95 antivirus engines, indicating it has not yet been widely flagged by security vendors. The domain was registered using a privacy-protected service, and its creation date has not been publicly disclosed. Google Safe Browsing (GSB) status shows no blocklisting, and the current count of public blocklists referencing this domain remains at zero. These factors suggest a recently deployed or lightly used phishing operation, likely targeting users through email or social engineering campaigns. The domain remains active and under analysis as of the latest assessment. While no immediate takedown action has been recorded, security teams may block the associated IP or issue future GSB warnings based on emerging intelligence. The current risk is assessed as under investigation, but users are strongly advised to avoid interacting with z.gettrustpayment.live or entering any information. If this domain was accessed, users should immediately change passwords, monitor financial accounts, and scan devices for malware. The presence of a Let’s Encrypt certificate highlights the need for users to verify domain legitimacy through official channels, as SSL does not guarantee safety. PhishDestroy recommends treating this domain as hostile and reporting any encounters to cybersecurity platforms for further analysis.