ezpass[.]paytsu[.]cc

The domain ezpass.paytsu.cc is identified as a toll service phishing site targeting electronic toll collection credentials. Analysis confirms this domain is currently offline, though it previously hosted active phishing infrastructure. No legitimate association with official toll service providers exists. Infrastructure analysis reveals the domain was created on June 12, 2026, and registered through Gname.com Pte. Ltd. It resolved to the IP address 188.114.96.3 and was flagged by 7 of 95 security vendors on VirusTotal. The domain appears on one security blocklist and was previously mitigated by network-level blocking. SSL certification was issued by Google Trust Services, and the site utilized Cloudflare with HTTP/3 support, indicating efforts to evade detection and enhance delivery speed. Current assessment indicates the domain is no longer active, though residual risk remains due to potential reuse of infrastructure. Organizations are advised to block the domain and associated IP at perimeter defenses. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. End users should be trained to recognize toll service phishing tactics, including unsolicited payment requests or credential harvesting prompts. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts.