zellepaisupportnumber[.]webflow[.]io

This domain, zellepaisupportnumber.webflow.io, is flagged for hosting a banking phishing scheme specifically targeting Zelle users. The threat type involves fake login portals designed to harvest credentials for financial fraud, classified as brand impersonation with elevated risk due to its direct targeting of banking customers. The page title, 'Zellepay Support Number | A fast way to send money | Zellepay Login | Zellepay Login error,' mimics legitimate Zelle branding to deceive users into entering sensitive account details. Analysis indicates the domain was created on March 02, 2026, and registered through Cloudflare, Inc. It resolved to IP address 172.64.151.8, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate was issued by Google Trust Services (WE1). At the time of detection, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious. It appeared on one security blocklist and was blocked by PhishDestroy. The domain is currently offline, but its infrastructure and historical activity warrant continued monitoring. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (172.64.151.8) at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing the domain or related phishing URLs. End-users should be educated on recognizing fake login pages, particularly those impersonating financial institutions, and advised to verify URLs before entering credentials. Financial institutions should monitor for unauthorized transactions linked to credentials potentially harvested from this domain. If credentials were exposed, affected users should reset passwords and enable multi-factor authentication on all financial accounts.