ezpass[.]paylky[.]cc

This domain, ezpass.paylky.cc, is identified as a credential theft operation impersonating electronic toll collection services. Analysis indicates the infrastructure was designed to harvest login credentials and payment details from unsuspecting users attempting to resolve toll charges. The domain exhibits no direct ties to known cryptocurrency drainer kits but aligns with broader credential harvesting campaigns targeting transportation and financial sectors. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd. and resolves to the IP address 172.67.183.196. VirusTotal detection metrics show 11 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy. No Google Safe Browsing (GSB) entries were recorded at the time of assessment, though this may reflect detection latency rather than benign status. The domain is currently offline, having been taken down following automated and manual intervention. Despite its inactive status, residual risk persists due to potential cached DNS entries or delayed user interaction with phishing emails or SMS messages directing traffic to the domain. Organizations are advised to monitor for failed authentication attempts or anomalous access patterns linked to toll service credentials. Network-level blocking of the IP 172.67.183.196 and the domain ezpass.paylky.cc is recommended as a precautionary measure. Users should verify all toll-related communications through official channels and avoid entering credentials on untrusted portals.