prozone-cc[.]cc

This domain, prozone-cc.cc, is identified as a phishing infrastructure designed to impersonate the legitimate Prozone payment portal (prozone.cc). Analysis indicates the site was actively used for credential harvesting and financial fraud, targeting users through cloned login and transaction pages. The domain is currently offline, but prior activity suggests it posed a direct threat to individuals and organizations interacting with Prozone services. Infrastructure analysis reveals the domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited. It resolved to the IP address 91.240.20.27 and employed a Let's Encrypt SSL certificate to mimic legitimacy. The site was flagged by 7 of 95 security vendors on VirusTotal and appeared on one blocklist, specifically PhishDestroy. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. Detected technologies included Node.js, PHP, Vue.js, Nuxt.js, Apache HTTP Server, and Google Analytics, suggesting a sophisticated frontend designed to evade basic detection mechanisms. The domain has since been taken offline, but residual risks remain for users who may have interacted with it prior to deactivation. Organizations are advised to monitor network logs for connections to 91.240.20.27 and prozone-cc.cc, particularly from endpoints that accessed Prozone services during the active period. Users should be instructed to reset credentials if they entered login details on the site. Domain registrars and hosting providers are encouraged to review related infrastructure for similar phishing campaigns, given the use of common bulletproof hosting patterns.