ajvcu[.]cn

Analysis of ajvcu.cn shows a high‑risk, active phishing infrastructure. The domain was registered on 11 November 2025 by the registrar 成都伊索信息科技有限公司 and currently resolves to the IPv4 address 156.234.7.18. DNS resolution is served by four nameservers – ns1.julydns.com, ns2.julydns.com, ns1.onclouddns.com and ns2.onclouddns.com – suggesting a multi‑provider setup that can aid resilience against takedown attempts. The domain appears on three public blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, confirming that threat‑intel feeds have identified it as malicious. VirusTotal scans have returned five positive detections out of ninety‑five submitted security engines, providing additional independent confirmation of malicious behavior. While the specific phishing campaign content (page title, targeted brand, or credential‑capture mechanism) has not been disclosed, the combined indicators of recent registration, active DNS, blocklist presence, and multiple vendor detections constitute a robust evidence set that the domain is being used for credential‑stealing or related fraud. Defenders should block network traffic to 156.234.7.18 and enforce DNS filtering for ajvcu.cn across perimeter and endpoint solutions. Security teams should also monitor for related domains that share the same nameserver configuration or exhibit similar registration patterns, and consider adding ajvcu.cn to internal block lists and email‑gateway policies to prevent user exposure. Continuous re‑evaluation is advised in case additional intelligence, such as payload samples or phishing page screenshots, becomes available.