superapp[.]zebeci[.]co

Analysis of superapp.zebeci.co indicates that the domain was registered on 27 February 2026 through PublicDomainRegistry.com (operated by PDR Ltd.) and immediately pointed to Cloudflare’s network (AS13335) with the address 172.67.208.86. The site has been observed serving a single HTTP response with the title “Just a moment…”, after which the hosting was taken offline. No TLS certificate was presented, confirming the absence of HTTPS protection. The domain appears on three independent phishing blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that external threat‑sharing feeds have classified it as malicious.

VirusTotal recorded a single positive detection out of 93 scanning engines, further corroborating the malicious rating. Gridinsoft’s proprietary trust scoring assigned a zero‑point rating, the lowest possible score. The nameserver configuration uses johnathan.ns.cloudflare.com and sierra.ns.cloudflare.com, both standard Cloudflare resolvers, which does not provide additional attribution beyond the hosting provider. Because the site is currently offline, content‑level analysis is limited to the page title; no further indicators such as login forms, credential‑stealing scripts, or brand impersonation have been documented.

Defenders should therefore treat the domain as a confirmed phishing infrastructure and enforce blocking at the DNS and URL filtering layers. Monitoring of the originating IP 172.67.208.86 is advisable, as Cloudflare may host additional malicious actors sharing the same edge network. Organizations using threat‑intelligence feeds should ensure the three listed blocklists are integrated into their security controls, and any future domains registered by the same registrar within a similar time window should be scrutinized. Continuous re‑validation is recommended in case the domain is reinstated or the IP address is reassigned to new malicious content.