state[.]vnwpay[.]cc

Analysis of the domain state.vnwpay.cc shows an active generic phishing infrastructure that surfaced on September 21, 2025. The domain is registered through Dominet (HK) Limited and resolves to the IPv4 address 188.114.97.3. It appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service.

VirusTotal scans have returned five positive detections out of ninety‑one submitted security vendors, indicating that a minority of AV engines have identified malicious behavior associated with the host. No additional intelligence such as page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts is currently available, and the exact content served by the site has not been publicly disclosed. Consequently, the precise brand or service being spoofed remains unknown, and the threat actor’s tactics, techniques, and procedures (TTPs) cannot be fully characterized at this stage.

Defenders should prioritize adding state.vnwpay.cc to network and endpoint blocklists, enforce DNS filtering policies that deny resolution of the domain, and monitor outbound connections to the IP address 188.114.97.3 for anomalous activity. Security operations teams are advised to update intrusion detection signatures to flag any HTTP requests targeting this host and to correlate logs for potential credential harvesting attempts. Continuous re‑evaluation is recommended as further analysis, such as page content inspection or sandbox execution, may reveal additional indicators of compromise.