app[.]zebecsol[.]digital

On 24 July 2026 investigators observed that the domain app.zebecsol.digital is currently offline but retains several indicators of malicious phishing infrastructure. The domain was registered on 27 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is delegated to the Cloudflare nameservers audrey.ns.cloudflare.com and rohin.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. No TLS certificate is presented for the host, indicating that HTTPS is not configured.

The page that was captured before takedown returned the title “Just a moment…”, a generic placeholder often used by automated phishing kits. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal analysis shows that six of ninety‑three antivirus and URL scanners flagged the domain, confirming that multiple security products have observed suspicious behavior. The domain is listed on at least one security blocklist and has been actively blocked by the PhishDestroy mitigation service.

The intelligence tags the activity as a crypto scam, suggesting that the site was intended to lure victims into disclosing cryptocurrency credentials or transferring funds. Although the site is no longer reachable, its recent creation date, low trust score, lack of encryption, and presence on blocklists collectively indicate an elevated risk profile. Defenders should continue to block traffic to app.zebecsol.digital at the network perimeter, monitor DNS queries for the associated Cloudflare nameservers, and add the IP address 188.114.97.3 to any relevant threat‑intel feeds. Ongoing observation of the registrar and any future re‑registrations is advised, as the same infrastructure may be reused for subsequent campaigns.