zbcn[.]hadin[.]net

PhishDestroy identifies zbcn.hadin.net as an active confirmation stealing phishing site impersonating secure verification flows. The domain employs social engineering tactics to harvest victims’ authentication credentials and session tokens under the guise of routine account validation. No specific brand or drainer kit family has been attributed yet; investigation remains ongoing to map infrastructure to known malware families or transnational threat actors.

Technical analysis confirms zbcn.hadin.net resolving to 45.140.205.214 with a Let's Encrypt SSL certificate and domain creation dated May 07, 2012. The registrar is listed as Gname.com Pte. Ltd., and VirusTotal currently shows 3 out of 95 detection engines flagging the page. Google Safe Browsing has not blacklisted this domain, and public blocklists contain no current entries. These characteristics indicate early-stage malicious hosting with low third-party visibility.

Current status shows the phishing page remains live and fully operational, with the page title “Secure Verification” in use. Despite zero detection coverage and a benign registration profile, this domain poses an active threat to users expecting legitimate verification portals. Users should avoid interacting with any login prompts on zbcn.hadin.net, and system administrators are urged to block the IP 45.140.205.214 and domain at network edge. Remaining risk is assessed as active and significant until takedown occurs or detection signatures mature. Investigative seed: 5caef7.