allocation-zebec[.]app

PhishDestroy identifies allocation-zebec.app as an active brand impersonation phishing domain targeting enterprise users under investigation for credential theft.

This domain, registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 24, 2024, resolves to IP 172.67.163.4 and is served via a Let’s Encrypt SSL certificate. VirusTotal currently flags the domain as clean with 0 detections across 95 vendor engines, indicating it remains undetected by major security platforms. The domain’s recent creation and minimal blocklist presence suggest it is part of a newly launched campaign with low public exposure to date.

Current status remains active with delivery vectors likely including email spam, social media impersonation, or spoofed service advertisements. Indicators of compromise include the domain itself, its resolving IP 172.67.163.4, and SSL issuer Let’s Encrypt. Users are advised to block the domain and IP at the network perimeter, avoid clicking any links or downloading content, and report the domain to their security teams and abuse channels. Monitor for unauthorized login attempts and credential leaks associated with this campaign. Organizations should update threat intelligence feeds and firewall rules to include allocation-zebec.app and 172.67.163.4 as indicators of compromise.