mashangyoushu[.]cn

The domain mashangyoushu.cn is currently flagged as high‑risk generic phishing. It was registered on 2019-05-09 through Alibaba Cloud (万网) and uses the authoritative nameservers dns7.hichina.com and dns8.hichina.com. The domain resolves to IP 39.96.24.137, which is owned by AS37963 Hangzhou Alibaba Advertising Co., Ltd. in China. The web server returns HTTP 200 and presents the page title "马上有书"; no further visual or functional analysis is publicly available. The site is listed on two public blocklists (PhishDestroy and PhishingDB) and appears in 25 AlienVault OTX pulses, indicating repeated observation by threat‑intel sources. Google Safe Browsing categorizes the URL under SOCIAL_ENGINEERING, and VirusTotal scans show 16 of 93 security vendors flag the domain as malicious. The TLS certificate issued by DigiCert Inc (Encryption Everywhere DV TLS CA - G2) confirms normal HTTPS operation but does not mitigate the phishing risk. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. Uncertainties remain regarding the exact payload, credential‑harvesting techniques, or targeted brands, as the page content has not been dissected. Nevertheless, the convergence of blocklist listings, multiple OTX pulses, and a low trust score suggests an active phishing infrastructure. Defenders should block mashangyoushu.cn at network perimeters and DNS resolvers, monitor for outbound connections to 39.96.24.137, and update endpoint detection signatures with the 16 VirusTotal detections. Ongoing monitoring of threat‑intel feeds is advised to capture any changes in classification or additional indicators.