Is zebec.my a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is the website zebec.my, a very recently registered domain under the Malaysian country-code suffix. When analysed, it presented only a short security interstitial from its edge provider, titled as a suspected-phishing warning, instead of ordinary site content. The site's products, services and business model could therefore not be established from what it displayed. Its apparent purpose remains undetermined, and the interstitial is itself a cautionary indicator.

Scam/Impersonation Risk

This site carries a confirmed adverse reputation. A substantial cluster of independent security engines currently classifies the domain as malicious, and several of the best-known enterprise security vendors are among them. The domain is blacklisted on that basis. These detections are decisive and outweigh every mitigating factor. The edge-provider interstitial labelled the page as suspected phishing, which points in the same direction. No conflicting legal identities and no confirmed brand impersonation were established. The cautionary posture rests on the blacklisting and the phishing indication, not on any identified claim made by the site. The domain is also very young, and its archive history is thin and shows no long operating record. Behavioural testing showed no wallet-connection prompts, clipboard manipulation, hidden forms or external credential posts. However, a very high share of the page's network activity went to third-party destinations, and the page produced a large number of script errors. That pattern fits a thin or unstable front end that relies heavily on outside resources. No contact email was observed in the captured content. Evidence:

• Domain registered in 2026 (~0.27 years old), so the site has no multi-year operating record.
• 1 archive snapshot, dated 2026-08-01, spanning 1 year tracked, so there is no continuity of history to rely on.
• The captured homepage was a challenge page titled as a suspected-phishing warning, and no genuine site content was retrieved.
• Behavioural runs recorded 29 external fetch requests, 9 external POSTs and 34 console errors, with no wallet-drainer or clipboard-hijack activity.

Regulatory Verification Notes

The real-world operator behind this domain has not been independently established. No licence, registration or legal-entity information could be assessed, because no legal, terms or about content was captured. Third-party broker-reputation data returned no match. That is neutral and does not offset the threat-intelligence listings. The domain was registered through Dynadot, a mainstream commercial registrar, and registration is shielded by that registrar's privacy service. Both are administrative details and do not change the assessment. The site is served over a valid but entry-level, domain-validated certificate. Such certificates confirm only control of the domain, not the operator's identity, and are freely available to any registrant, including malicious ones. The security-forward posture therefore stands independently of any licensing question. Evidence:

• Registrar recorded as Dynadot LLC, with registration through Super Privacy Service LTD c/o Dynadot.
• TLS certificate issued by WE1 (DV), valid to 2026-12-17.
• Served from AS13335 (Cloudflare, Inc., US).
• No third-party broker profile exists for this domain.

What to Verify Next

Before any engagement, confirm through the official channels of any organisation that this domain claims or appears to be associated with whether it endorses zebec.my. Use independently sourced channels, not links or contact details taken from the site itself. If the site ever presents itself as a financial or digital-asset service, check the claimed operator against the relevant national licensing registry. Re-test the domain later to see whether the current listings have been cleared. Report the domain to the issuing security vendors if it was reached through an unsolicited message, advertisement or social-media post. Evidence:

• The domain is recent, and its current reputation record is adverse.
• No operator identity was established from the captured page.
• Re-testing is the only way to determine whether the listings are transient or persistent.

Summary Verdict

The overall posture is high-risk and clearly cautionary. Active security-vendor detections, a phishing-flagged interstitial and a brand-new domain with almost no history converge on the same conclusion. The technical hygiene signals of a valid certificate and non-anomalous behavioural testing do not change it. This is a critical-risk assessment.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is an edge node. The origin host was not observable, so the real hosting location cannot be independently verified. This also means content could change behind the edge without any visible infrastructure change. Edge protection is a mitigating factor for availability and basic transport hygiene only. It does not offset the threat-intelligence findings.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any financial interaction, and nothing should be downloaded from it. Any contact with the domain should be confined to passive viewing from an isolated environment, and avoiding it entirely is preferable. Anyone who has already interacted with it should change reused passwords and review the connected accounts and wallet permissions.