mahjxs[.]us[.]cc

mahjxs.us.cc is currently listed on a single security blocklist and is actively blocked by the PhishDestroy service. The domain remains active and resolves to the IPv4 address 43.133.41.74. VirusTotal analysis shows that five of ninety‑one scanning engines have flagged the domain as malicious, indicating a non‑trivial detection rate among reputable scanners. Registration data reveals that the domain was created on 7 April 2006 and is registered through Gname.com Pte. Ltd., a registrar that is frequently observed in malicious infrastructure.

The authoritative name servers for the zone are a.rsp-dns.com, b.rsp-dns.com, ns1.domainnamens.com, and ns2.domainnamens.com, all of which are commonly used by fast‑flux or compromised hosting providers. No public information about SSL certificates, HTTP response codes, or page titles is available, so the exact content served by the site cannot be verified at this time. The lack of additional intelligence leaves uncertainty regarding the specific phishing lure or credential‑ harvesting technique employed. However, the combination of blocklist presence, active blocking by PhishDestroy, multiple vendor detections, and the use of shared DNS infrastructure strongly suggests that the domain is being used for generic phishing campaigns.

Defenders should add mahjxs.us.cc to their deny lists, enforce DNS‑level blocking, and monitor outbound traffic for connections to 43.133.41.74. Continuous re‑scanning of the domain on VirusTotal and other sandboxes is advised to capture any changes in payload or hosting. Organizations using threat‑intelligence platforms should correlate this indicator with internal logs to detect possible user exposure. Because the domain is older than a decade, it may be part of a long‑standing malicious infrastructure; therefore, periodic review of associated name servers and IP ranges is recommended.