ezpass[.]payrom[.]cc

The domain ezpass.payrom.cc has been identified as a phishing site specifically designed to impersonate E-ZPass, a widely used electronic toll collection system in the United States. Analysis indicates this infrastructure was engineered to harvest credentials, payment details, and personal information from unsuspecting users attempting to settle toll charges. As of the latest verification, the domain has been taken offline, though prior activity remains a documented threat. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.55.194, a hosting provider commonly utilized for transient phishing campaigns. Security telemetry shows the domain was flagged by 10 of 95 vendors on VirusTotal, with detections including credential theft and brand impersonation. Additionally, the domain appeared on one security blocklist, further corroborating its malicious classification. The SSL certificate, issued by Google Trust Services, was likely employed to lend an appearance of legitimacy to the fraudulent site. Current status confirms ezpass.payrom.cc is offline, though the underlying infrastructure may remain dormant or repurposed. Organizations and individuals are advised to block the domain and its associated IP (104.21.55.194) at the network perimeter. Users who may have interacted with the site should immediately reset credentials for any accounts linked to toll services or financial transactions. Monitoring for unauthorized access or fraudulent charges is strongly recommended, particularly for those who entered payment details on the site.