ezpass[.]paytsz[.]cc

This domain, ezpass.paytsz.cc, operates as a phishing site designed to mimic legitimate electronic toll collection services. Analysis indicates its primary objective is credential harvesting, specifically targeting users of toll payment systems. The site presents fraudulent login interfaces to deceive visitors into submitting sensitive account details, including usernames, passwords, and payment information, which are then captured by threat actors for unauthorized access or financial fraud. Evidence supporting this assessment includes detection by 10 out of 95 security vendors on VirusTotal, indicating a consensus among multiple engines regarding its malicious nature. The domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Infrastructure analysis reveals it resolves to the IP address 172.67.173.157 and is currently listed on one security blocklist. The SSL certificate issued by Google Trust Services does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Users who visited ezpass.paytsz.cc should immediately take corrective actions. If credentials were entered, change passwords for the affected account and any other services where the same credentials were reused. Enable multi-factor authentication where available to add an additional layer of security. Monitor financial statements and toll account activity for unauthorized transactions. Clear browser cache and cookies to remove any residual session data. Report the incident to the legitimate toll service provider and consider notifying relevant cybersecurity authorities to aid in tracking and mitigating the threat.