wenshu[.]tw

The domain wenshu.tw, registered through GANDI SAS on April 13, 2022, is currently active and resolves to the IP address 188.114.97.3. Infrastructure analysis shows the domain is listed on one public security blocklist and is actively blocked by the PhishDestroy service, indicating prior detection of malicious use. VirusTotal records reveal that the domain has been scanned by 95 antivirus and URL‑reputation vendors; at the time of the latest scan no detections were reported, though the absence of a flag does not constitute evidence of safety.

The domain is served via Cloudflare, as evidenced by the authoritative nameservers james.ns.cloudflare.com and magdalena.ns.clou, which provide typical DDoS mitigation and CDN services but also obscure the origin server. No publicly available SSL certificate details, HTTP response codes, or page title information have been disclosed, leaving the exact nature of the hosted content unverified. Given the generic phishing classification, the presence on a blocklist, and the active status of the domain, defenders should continue to treat wenshu.tw as a potential threat.

Recommended actions include maintaining existing block rules, monitoring DNS queries for the domain, and, where feasible, adding the IP 188.114.97.3 to network‑level denial lists. Organizations should also consider reviewing outbound traffic to Cloudflare‑hosted domains for anomalous patterns, and employ threat‑intel feeds that reference the domain’s blocklist entry to augment detection capabilities. Until further forensic analysis of the site content is performed, the domain's risk remains under investigation.