state[.]zerpay[.]cc

The domain state.zerpay.cc was registered through Dominet (HK) Limited on September 22, 2025. Current DNS resolution points exclusively to the IPv4 address 188.114.97.3, an IP that is not associated with any known corporate infrastructure and is frequently leveraged for malicious hosting. VirusTotal scans show that five of ninety‑one security vendors have flagged the domain, indicating that at least a subset of detection engines recognize it as malicious.

The domain is listed on a single public security blocklist and has been actively blocked by the PhishDestroy feed, confirming that defensive communities have observed abusive activity tied to this host. No additional telemetry such as Safe Browsing status, Open Threat Exchange entries, SSL certificate details, HTTP response codes, or trust‑score metrics are presently available for analysis. Likewise, the page title and any explicit brand impersonation have not been disclosed, leaving the precise phishing vector uncertain.

Analysts should treat the domain as an active threat and incorporate it into URL filtering, DNS sink‑hole, and endpoint protection policies. Continuous monitoring of the IP address 188.114.97.3 for new associations and periodic re‑scans on VirusTotal are recommended to capture any evolution in the threat profile. Organizations that rely on web‑based authentication should educate users to verify URLs carefully, especially when unexpected login prompts appear, and to report any suspicious redirects to their security operations center.