state[.]zedpay[.]cc

Analysis of state.zedpay.cc confirms its classification as an active phishing domain targeting ZedPay users, with elevated risk due to recent registration and detection by security vendors. The domain was created on September 22, 2025, and is currently resolving to IP address 172.67.195.139, which is associated with Cloudflare infrastructure. While specific hosting details beyond the IP are not provided, the use of a content delivery network is consistent with tactics to obscure origin servers and evade takedowns. The domain is registered through Dominet (HK) Limited, a registrar frequently observed in abuse reports for phishing and fraudulent domains. Six of 91 security vendors on VirusTotal have flagged state.zedpay.cc as malicious, indicating a moderate but not yet overwhelming consensus among detection engines.

The domain appears on at least one security blocklist, specifically PhishDestroy, which further corroborates its malicious classification. No additional details regarding the page title, brand impersonation specifics, or phishing kit are available in the current intelligence, limiting the ability to determine the exact lure or payload structure. However, the domain name itself strongly suggests an intent to impersonate ZedPay, a financial services platform, likely aiming to harvest user credentials or sensitive account information. Defenders should treat this domain as an active threat and prioritize blocking both the domain and its resolving IP address at the network level.

Security teams are advised to monitor for indicators of compromise (IOCs) associated with this domain, including any subdomains or related infrastructure that may emerge. Given the domain's recent creation and ongoing detection by security vendors, it is reasonable to expect continued malicious activity unless disrupted.