state[.]wtrpay[.]cc

state.wtrpay.cc is a subdomain of wtrpay.cc. PhishDestroy first recorded this hostname on Jun 12, 2026. The assembled evidence scores 65/100 (elevated).

One independent source is positive: VirusTotal. VirusTotal recorded 5 detections among 91 engines: Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar, Webroot on Jul 29, 2026 at 03:25 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Jul 29, 2026 at 03:26 UTC. URLScan completed without a malicious verdict (score 0) on Jul 30, 2026 at 08:14 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:32 UTC; content was unavailable. Registration records for the registrable domain wtrpay.cc list Dominet (HK) Limited as the registrar and Sep 21, 2025 as the creation date. At collection time, the hostname resolved to 172.67.207.106 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cloudflare. Captured page title: “wtrpay.cc | 520: Web server is returning an unknown error”. The evidence archive retains 1 visual capture from PhishDestroy. IoC extraction completed on Aug 1, 2026 at 04:07 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists WE1 as the certificate issuer.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.