state[.]wtrpay[.]cc

The domain state.wtrpay.cc is actively serving as a generic phishing vector. Technical analysis shows that the name resolves to the IPv4 address 172.67.207.106. Registration records indicate the domain was created on September 21, 2025 and was registered through Dominet (HK) Limited, a registrar located in Hong Kong. The domain has been listed on a single public security blocklist and is currently blocked by the PhishDestroy filtering service.

VirusTotal scans have returned detections from five of ninety-one security vendors, confirming that multiple commercial engines consider the host malicious. The risk rating is elevated and the operational status is marked as active. No additional public intelligence such as page titles, SSL certificate details, or HTTP response codes is available at the time of writing, leaving the exact content and phishing landing page uncharacterized. Defenders should immediately add state.wtrpay.cc to outbound web filters, firewall deny lists, and DNS block policies.

Continuous monitoring of DNS queries for the 172.67.207.106 address is advised to detect any potential pivoting or reuse of the hosting infrastructure. Where possible, integrate the domain into intrusion detection and prevention signatures, and consider sinkholing the address to disrupt further malicious activity. Because the underlying hosting provider and content have not been publicly disclosed, threat hunters should also review recent traffic logs for any connections to the IP address or domain to identify compromised client systems. Ongoing investigation should focus on retrieving the HTTP response, analyzing any associated payloads, and correlating with other indicators of compromise that may share the same hosting environment.