state[.]zetpay[.]cc

The domain state.zetpay.cc is currently active and has been identified as a generic phishing infrastructure. DNS resolution points to the IPv6 address 2606:4700:3035::6815:235a, indicating that the host is reachable on the public Internet. The registration record shows that the domain was created on September 22, 2025 and is listed under the registrar Dominet (HK) Limited, a provider known to host a variety of short‑lived malicious domains. Threat intelligence feeds have placed the domain on one security blocklist and it is explicitly blocked by the PhishDestroy service, suggesting that at least some defensive platforms have already taken remediation steps.

VirusTotal analysis reveals that 7 out of 91 security vendors have flagged the domain as malicious, providing additional corroboration of its abusive nature. No public information is available regarding the site’s SSL certificate, HTTP response codes, page title, or any specific brand it may be attempting to impersonate; these elements remain unverified. Defenders should prioritize immediate containment by adding state.zetpay.cc to outbound and inbound firewall deny lists, ensuring that DNS filtering solutions also block resolution to the associated IPv6 address. Network monitoring should include alerts for any connections to the address 2606:4700:3035::6815:235a, and logs should be examined for prior accesses that might indicate compromise.

Because the domain is relatively new, threat hunters should watch for related patterns that emerge from the same registrar or similar IPv6 prefixes. Updating endpoint protection signatures and confirming that web proxy and secure web gateway policies reference the latest blocklists will reduce the risk of user exposure. Continuous re‑evaluation is advised, as additional detection data may surface that further clarifies the campaign’s scope and objectives.