state[.]gmrpay[.]cc

Analysis of the domain state.gmrpay.cc indicates it is an active phishing infrastructure targeting payment processing systems. Registered on September 21, 2025, through Dominet (HK) Limited, the domain currently resolves to IP address 104.21.10.94. As of July 29, 2026, the domain is flagged by 5 of 91 security vendors on VirusTotal and appears on one security blocklist, suggesting elevated risk. The detection ratio remains low, which may reflect limited visibility or recent activation of the threat.

Infrastructure analysis reveals the domain uses Cloudflare IP space (104.21.10.94), a common tactic to obscure hosting providers and evade IP-based blocking. No specific brand or payment service is confirmed as the impersonation target based on available data, though the 'gmrpay' subdomain suggests a focus on payment or transactional fraud. The exact content of the site has not been analyzed, so the presence of credential harvesting forms, payment redirection, or other malicious functionality remains unconfirmed. Defenders should treat this domain as an active phishing threat.

Block access at the DNS or network level, and monitor for connections to 104.21.10.94. Given the domain's age (10 months) and low detection count, it may represent a newer or targeted campaign. Further investigation into SSL certificates, HTTP headers, and page content is recommended to determine the specific scam mechanics and potential brand impersonation. No evidence currently links this domain to a known phishing kit or broader campaign.