cabbage[.]cyclamen-zjk[.]comwww[.]hzboligang[.]com

The domain cabbage.cyclamen-zjk.comwww.hzboligang.com is currently classified as a high‑risk Apple brand‑impersonation site. It was registered on 13 March 2026 through West263 International Limited and remains active as of 12 July 2026. The site presents a generic “Home” page and serves content over HTTPS using a Let’s Encrypt R13 certificate, indicating that encryption is deliberately provided to increase credibility.

Network analysis shows the domain resolves to the IPv4 address 172.247.146.162, which belongs to AS40065 (CNSERVERS LLC) located in the United States. Authoritative name servers are ns1.myhostadmin.net, ns2.myhostadmin.net, ns3.myhostadmin.net, and ns4.myhostadmin.net. The web server reports HTTP 200 and employs Nginx with HSTS and HTTP/3 enabled, while the front‑end stack includes Bootstrap, jQuery, and the Slick carousel library.

Reputation services assign a Gridinsoft trust score of 0 / 100, and VirusTotal records only two of ninety‑five scanners flagging the domain as malicious. The site is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service. The low number of detections suggests limited visibility in the broader security community, leaving uncertainty about the full extent of the campaign’s infrastructure and any additional payloads that may be delivered.

Defenders should add the full host name to DNS filtering rules and block outbound connections to 172.247.146.162. Network‑level detection can be reinforced by monitoring TLS handshakes for the Let’s Encrypt R13 certificate and by flagging HTTP/3 traffic to the identified name servers. Incident response teams are advised to educate users about unsolicited Apple‑related support prompts, as the site appears to employ a tech‑support scam narrative. Continuous re‑evaluation of VirusTotal and other sandbox results is recommended to capture any future changes in malicious behavior.