zellepaaysupportnumber[.]webflow[.]io

Analysis of zellepaaysupportnumber.webflow.io shows a domain created on 2 March 2026 that is presently taken offline. The site presented a page title reading "Zellepay Support Number | Fast way to get money | Zellepay Login," indicating an attempt to lure victims seeking Zelle payment services. The domain resolves to 172.64.151.8, an address owned by AS13335 Cloudflare, Inc. in the United States, and the hosting environment reports Cloudflare services with HTTP/3 enabled. The TLS certificate is issued by Google Trust Services under the WE1 identity, confirming the use of a legitimate certificate authority but offering no protection against the underlying malicious intent.

Security monitoring recorded the domain on a single blocklist and it was flagged by PhishDestroy, which has taken the site offline. VirusTotal analysis returned 16 positive detections out of 93 scanned vendors, reinforcing the classification as a phishing resource. The HTTP response code returned 404, suggesting the payload page is no longer reachable, yet the prior presence of a login‑related title implies a credential‑harvesting page was once hosted. Uncertainty remains regarding the exact content of the removed page, the specific phishing kit employed, and whether any victim data was exfiltrated before takedown.

Defenders should continue to block the domain at network perimeter, monitor for any residual DNS or IP activity, and incorporate the domain hash into threat‑intelligence feeds. Users should be warned that any unsolicited communications referencing a Zelle support number from this domain are fraudulent, and credential entry on such pages should be avoided. Ongoing vigilance is advised, especially for organizations that process Zelle transactions, to detect any attempted credential reuse tied to this compromised domain.