zelleapayhelplinenumber[.]webflow[.]io

This domain operates as a banking phishing page designed to impersonate Zelle support services, specifically targeting users searching for login assistance or helpline numbers. The page title indicates fake customer support and login error resolution themes, which are commonly used social engineering lures to prompt victims into entering sensitive banking credentials, verification codes, or personal financial information. The infrastructure is consistent with credential harvesting campaigns rather than legitimate service provisioning.

Technical indicators show multiple independent risk signals. VirusTotal reports 23/95 security vendors flagging the domain as malicious. The domain was created on March 13, 2026 and is registered through Webflow, a platform often used for rapid deployment of web content. SSL is issued by Google Trust Services (WE1), indicating automated certificate provisioning. DNS resolves to 172.64.151.8 under AS13335 (Cloudflare, Inc.), suggesting reverse proxy hosting. Additionally, the domain appears on 1 security blocklist (PhishDestroy), and has since been taken offline.

If a user interacted with this domain, immediate actions are recommended. Any credentials entered should be considered compromised and banking institutions should be notified to secure accounts and monitor fraudulent activity. Users should reset passwords, enable multi-factor authentication, and review recent account transactions for unauthorized access. Systems used to access the site should be scanned for malware or browser persistence mechanisms. Continued monitoring is advised, as phishing campaigns often reuse similar infrastructure patterns and re-register domains under alternate subdomains or hosting configurations.