snapshot-zebec[.]xyz

The domain snapshot-zebec.xyz has been identified as a phishing site specifically designed to impersonate Zebec Protocol, a cryptocurrency payment and streaming platform. This domain targets users attempting to interact with legitimate Zebec services, likely aiming to harvest wallet credentials, private keys, or other sensitive authentication details through fraudulent interfaces. As of the latest verification, the domain has been taken offline, though prior activity remains a documented threat. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was flagged by 5 of 95 security vendors on VirusTotal, indicating a moderate but confirmed detection rate. It was registered on June 12, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolved to the IP address 104.21.52.164, a Cloudflare-hosted endpoint often exploited to obscure origin infrastructure. Additional infrastructure analysis shows the domain appeared on four distinct security blocklists, and it received a trust score of 0 out of 100 from Gridinsoft, reinforcing its classification as a high-risk asset. Notably, the domain was proactively blocked by multiple cryptocurrency security platforms prior to takedown. While snapshot-zebec.xyz is currently offline, the threat infrastructure may persist or re-emerge under similar naming conventions. Organizations and individuals are advised to verify domain authenticity before interacting with any cryptocurrency-related service, particularly those involving wallet connections or token transfers. Network administrators should incorporate the domain, IP address, and registrar details into threat intelligence feeds for retrospective detection. Users who may have interacted with this domain should immediately revoke any connected wallet permissions, monitor for unauthorized transactions, and consider rotating credentials associated with affected accounts. Continuous monitoring of newly registered domains with similar naming patterns is recommended to preemptively identify related threats.