ezpass[.]paytsa[.]cc

The domain ezpass.paytsa.cc is identified as a generic phishing site, posing a significant threat to users who may encounter it. The domain is associated with the brand EZ Pass, a common target for phishing due to its widespread use and the sensitive financial information it handles. No specific drainer kit has been identified during the analysis, but the domain's infrastructure and behavior suggest it is part of a broader phishing campaign.

Infrastructure analysis reveals that ezpass.paytsa.cc has a VirusTotal (VT) score of 11/95, indicating that a notable portion of security vendors recognize it as a potential threat. The domain is registered through Gname.com Pte. Ltd., a registrar that often sees abuse by malicious actors. The domain was created on June 12, 2026, and resolves to the IP address 104.21.63.95. Additionally, the domain is flagged by PhishDestroy, a security service that tracks and blocks phishing sites, and appears on one security blocklist, further corroborating its malicious nature.

Currently, the domain is offline, which mitigates the immediate risk to potential victims. However, the elevated risk level and the domain's presence on blocklists suggest that it was actively used for phishing activities before being taken down. Organizations and individuals should remain vigilant and ensure that no cached or redirected traffic attempts to access this domain. Ongoing monitoring and education of users about phishing threats are recommended to prevent future incidents involving similar domains.