cf-4[.]nxnrllbe[.]eu[.]org

The domain cf-4.nxnrllbe.eu.org is actively serving content over HTTP with a 200 status code and is classified as a high‑risk brand‑impersonation campaign targeting China Central Television. It resolves to the address 104.21.19.48, an IP block assigned to a large network operator in the United States. The site’s page title matches the official broadcaster’s branding, indicating a deliberate attempt to masquerade as a legitimate CCTV service.

Infrastructure analysis reveals that the domain was registered through the publicly listed registrar and is protected by an SSL certificate issued by a widely recognized Certificate Authority, displaying the identifier WE1. The hosting environment exhibits characteristics of a content delivery network and includes a common JavaScript library, alongside support for HTTP/3, suggesting a modern web stack designed for rapid content delivery and evasion of simple static analysis.

Detection metrics show the domain is listed on two public blocklists, specifically PhishDestroy and PhishingDB, and has been flagged by 16 of 95 scanners on a major malware aggregation platform. The Gridinsoft trust scoring system assigns a zero out of one hundred rating, reinforcing the assessment of malicious intent. The combination of these indicators aligns with the observed brand‑impersonation tactics and confirms the domain’s inclusion on multiple security monitoring feeds.

Defenders are advised to block the domain and its associated IP address at network perimeters, incorporate the domain into URL filtering policies, and monitor for any outbound connections to the resolved IP. Continuous re‑evaluation of the domain’s status on threat‑intel feeds is recommended, as the active nature of the campaign may evolve to incorporate additional infrastructure or target variations.