update-zebec[.]com

The domain update-zebec.com was registered on 16 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolves to 172.67.155.128, an address owned by Cloudflare (AS13335) in the United States. The site is served behind Cloudflare with Browser Insights and HTTP/3 enabled, and presents a 301 redirect to a page titled “Zebec Network | Real‑Time Crypto Payroll & Payments”. The SSL certificate is issued by Google Trust Services under the WE1 intermediate. Security telemetry shows that seven of ninety‑one VirusTotal scanners have flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred. The domain appears on four external blocklists and is actively blocked by PhishDestroy, MetaMask, SEAL, and ScamSniffer. These indicators collectively point to a credential‑phishing campaign targeting users of the Zebec Network service. No additional infrastructure such as C2 servers, malware drops, or compromised accounts has been observed. The lack of publicly available content beyond the title means the specific phishing lures and credential collection mechanisms remain unknown. Defenders should continue to block the domain at network perimeter and endpoint filters, monitor for any login attempts to Zebec‑related services originating from the IP address, and advise users to verify URLs before entering credentials. Ongoing collection of payloads and page snapshots is recommended to refine detection signatures.