state[.]zeupay[.]cc

This domain, state.zeupay.cc, is flagged as a generic phishing threat with an elevated risk level and remains active as of the report date of July 29, 2026. The domain was created on September 22, 2025, and is registered through Dominet (HK) Limited. Infrastructure analysis reveals that it resolves to IP address 172.67.172.168, which is associated with Cloudflare, a common hosting provider used for both legitimate and malicious purposes.

VirusTotal data shows that 6 out of 91 security vendors flag this domain as malicious, indicating moderate detection coverage. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy, a threat intelligence platform. The exact content and purpose of the website have not been analyzed, so the specific brand or scam type is not confirmed; however, the domain name suggests a potential connection to a payment or state-related service, though no brand is explicitly named in the available intelligence.

Defenders should treat this domain as suspicious, monitor for any associated phishing campaigns, and block access at the network level. The elevated risk level warrants further investigation, including analysis of the site's content and any associated email or communication patterns, to determine the full scope of the threat. The domain's registration through a Hong Kong-based registrar and use of Cloudflare hosting may indicate an attempt to obscure the true origin of the operation.