state[.]zefpay[.]cc

Analysis conducted on July 29, 2026 indicates that the domain state.zefpay.cc is actively being used in a credential‑harvesting operation classified as generic phishing. The domain was registered on September 22, 2025 through Dominet (HK) Limited, a Hong Kong‑based registrar, and resolves to the IPv4 address 104.21.50.91. VirusTotal reports that five of ninety‑one scanning engines have raised detections against the domain, confirming that a subset of security products recognize malicious behavior. The domain appears on a single public blocklist and is specifically listed by the PhishDestroy blocking service, reinforcing its reputation as a threat vector.

The risk rating assigned by the reporting system is elevated, and the status remains active, suggesting ongoing malicious activity. Evidence available at the time of writing does not include SSL certificate details, HTTP response codes, page title, or content analysis, so the exact appearance of the hosted page remains unknown. Likewise, there is no public indication of Safe Browsing or Open Threat Exchange reporting for this host. Consequently, defenders should assume the site is intended to lure victims into submitting credentials or personal information, as is typical for generic phishing campaigns.

Mitigation guidance recommends adding state.zefpay.cc to DNS and URL filtering policies, enforcing blocklists that contain the domain, and restricting outbound connections to the hosting IP 104.21.50.91. Network monitoring should include alerts for any HTTP or HTTPS requests to the domain or its IP address. Organizations using threat‑intelligence feeds should verify that the domain is incorporated into their feed parsers, and security teams should consider sharing any new indicators of compromise with community blocklists to improve collective defense. Continuous re‑evaluation is advised, as additional analysis (e.g.