looginzellepayaccountt-3009dc[.]webflow[.]io

This domain, looginzellepayaccountt-309dc.webflow.io, is identified as a banking phishing resource specifically designed to impersonate the Zelle payment platform. Analysis confirms the domain was actively harvesting user credentials through a fraudulent login interface under the page title 'login Zellepay account | Fast way to get money | Zellepay Login.' The domain is currently offline, but prior activity indicates a targeted threat against financial account holders. Infrastructure analysis reveals the domain was registered through Webflow on March 07, 2026, and resolved to the IP address 172.64.151.8, hosted on AS13335 (Cloudflare, Inc.). Security validation shows 19 of 95 VirusTotal vendors flagged the domain as malicious, with an additional presence on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provided a false sense of legitimacy while facilitating encrypted credential theft. The domain's creation date suggests either a premature registration or a typo, as it predates the current date by several years, a tactic occasionally used to evade detection. Current status indicates the domain has been taken offline, likely due to enforcement action or hosting suspension. However, the infrastructure remains a residual risk, particularly if reactivated or mirrored on alternate domains. Users who accessed the site are advised to immediately reset Zelle and associated banking credentials, enable multi-factor authentication, and monitor financial statements for unauthorized transactions. Organizations should update web filtering rules to block the domain and its resolved IP, while security teams should investigate any prior connections to 172.64.151.8 for potential compromise indicators.