state[.]ewrpay[.]cc

PhishDestroy has identified state.ewrpay.cc as a malicious domain operating a fake cryptocurrency payment portal designed to harvest wallet credentials and drain funds. This domain was flagged under the generic_phishing category, specifically targeting users through deceptive transaction pages that mimic legitimate crypto payment gateways. No direct brand impersonation was observed, but the site employs a custom crypto drainer kit to trick victims into authorizing malicious transactions. Technical analysis reveals the domain resolves to the IP address 170.106.51.191, hosted on a provider commonly associated with fraudulent activity. VirusTotal reports 4 out of 95 security vendors have detected this domain as malicious, indicating moderate but growing awareness within the threat intelligence community. The domain was registered through an anonymous registrar, obscuring ownership details, and its creation date suggests it was recently deployed for short-term malicious use. Google Safe Browsing currently does not list the domain, and blocklist monitoring shows limited but increasing coverage across threat feeds. As of the latest scan, state.ewrpay.cc has been taken offline, likely due to hosting provider intervention or the operator abandoning the infrastructure. However, the risk remains elevated as the same threat actors may redeploy the domain or spin up new variants using similar naming conventions. Users who interacted with this domain should immediately revoke any wallet authorizations and monitor their accounts for unauthorized transactions. PhishDestroy recommends verifying all crypto payment portals through official channels and cross-checking domains on reputable threat intelligence platforms before engaging in any financial activity.