mzzf[.]gov[.]cn

Analysis indicates that the domain mzzf.gov.cn was registered on March 11 2026 through Chengdu Xiwei Digital Technology Co., Ltd. The authoritative name servers are ns1.teodns.com and ns2.teodns.com. The site resolves to 43.169.25.95, an address announced by AS139341 belonging to ACE in Singapore. The TLS certificate presented is issued by TrustAsia Technologies, Inc. under the TrustAsia DV TLS RSA CA 2025, confirming that HTTPS was active at the time of capture. The only visible page element is the title “Home”, and the domain is classified as a brand‑impersonation campaign targeting the brand celer. VirusTotal reported three detections out of ninety‑four scanners, and the domain appears on three public blocklists.

Additional intelligence sources include an AlienVault OTX pulse that references the domain, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The site is currently taken offline, but the infrastructure components—IP, nameservers, and certificate—remain observable and may be reused in future campaigns. Defenders should add the IP 43.169.25.95 and the domain mzzf.gov.cn to deny‑list rules across DNS, proxy, and web‑filter solutions.

Monitoring of the associated ASN (AS139341) for new host registrations is advised, as is periodic re‑query of the domain’s DNS records to detect resurrection. Correlating logs that reference the TLS certificate issuer or the “Home” page title can help surface residual connections. Because the campaign impersonates celer, any authentication or credential flows oriented toward that brand should be scrutinized for anomalous redirects to this domain. Continued sharing of this indicator with threat‑intel platforms will improve collective detection.