state[.]ewqpay[.]cc

Analysis of state.ewqpay.cc indicates an active phishing domain targeting payment processing systems. The domain was registered on September 21, 2025, through Dominet (HK) Limited, a registrar frequently associated with fraudulent infrastructure. As of July 29, 2026, the domain resolves to IP address 172.67.218.44, which is part of a network range commonly used for content delivery and proxy services, potentially obscuring the true origin of the malicious activity. VirusTotal telemetry reports that 6 out of 91 security vendors flag state.ewqpay.cc as malicious, suggesting moderate but not universal detection.

The domain appears on one additional security blocklist, and it is currently blocked by PhishDestroy, a specialized anti-phishing service. No data from Google Safe Browsing, AlienVault OTX, or other threat intelligence platforms is available at this time, limiting visibility into broader detection patterns or historical abuse. Infrastructure analysis reveals no SSL certificate details or HTTP response codes, leaving the operational status of the phishing page uncertain.

The exact content and targeted brand remain unconfirmed, as no page title or kit identification is available in the current evidence. Defenders should treat state.ewqpay.cc as an elevated-risk domain due to its registration context, detection by multiple vendors, and association with payment-themed phishing. Network-level blocking of 172.67.218.44 and monitoring for related subdomains under ewqpay.cc are recommended until further analysis clarifies the scope of the campaign.