state[.]zegpay[.]cc

This domain, state.zegpay.cc, is under investigation as an active credential-phishing site targeting users of the ZegPay platform. Registered on September 22, 2025, through Dominet (HK) Limited, the domain currently resolves to IP address 172.67.143.32, a Cloudflare-hosted endpoint commonly used to mask origin infrastructure. Analysis indicates the domain appears on at least one security blocklist, and six of ninety-one security vendors on VirusTotal have flagged it as malicious, corroborating its classification as a phishing threat. Infrastructure analysis reveals the domain is proxied behind Cloudflare, obscuring direct server attribution and limiting passive DNS visibility.

No SSL certificate details or HTTP response headers are currently available for deeper inspection. The domain's registration with a Hong Kong-based registrar and use of a content delivery network suggest an attempt to evade geofencing or takedown efforts. While the exact phishing kit or brand impersonation cannot be confirmed without active crawling, the domain name explicitly references ZegPay, a known digital payment service, indicating a likely credential-harvesting campaign. Defenders should treat this domain as elevated risk.

Network-level blocking is recommended for the domain and its resolving IP. Security teams are advised to monitor for connections to 172.67.143.32, particularly from endpoints with access to financial or payment systems. If internal logs show user interaction with state.zegpay.cc, immediate credential rotation and device inspection are warranted. Given the domain's recent creation and active blocklist presence, further monitoring for related infrastructure or newly registered lookalike domains is advised.