ezpass[.]paylkr[.]cc

This domain, ezpass.paylkr.cc, operates as a fraudulent toll payment portal designed to harvest sensitive financial credentials from unsuspecting users. Analysis indicates the site mimics legitimate electronic toll collection systems, tricking visitors into entering payment details, which are then captured by threat actors. The primary objective appears to be the theft of credit card information, banking logins, or other personally identifiable financial data, which can be exploited for unauthorized transactions or sold on underground markets. Infrastructure analysis reveals multiple technical indicators confirming its malicious nature. The domain was registered on June 12, 2024, through Gname.com Pte. Ltd., a registrar frequently associated with phishing campaigns. It resolves to the IP address 188.114.96.3 and holds an SSL certificate issued by Google Trust Services, a tactic often used to lend false legitimacy. Detection engines flagged the domain as malicious, with 8 out of 95 security vendors on VirusTotal identifying it as phishing-related. Additionally, it appears on two security blocklists, including PhishDestroy and OISD, further corroborating its fraudulent status. Users who visited ezpass.paylkr.cc should take immediate action to mitigate potential risks. First, cease all interaction with the domain and avoid entering any personal or financial information. If credentials were submitted, change passwords for all associated accounts, particularly those linked to banking or payment services, and enable multi-factor authentication where available. Monitor financial statements for unauthorized transactions and report any suspicious activity to the relevant financial institution. Consider running a full system scan using updated security tools to detect and remove any malware that may have been installed during the visit. Finally, report the domain to local cybersecurity authorities or platforms like the Anti-Phishing Working Group to aid in broader mitigation efforts.