cn[.]135manx[.]com

The domain cn.135manx.com is flagged as an active brand‑impersonation campaign that pretends to represent Google. Registration occurred on August 23 2017 through Wild West Domains, LLC and the zone uses UltraDNS name servers (pdns107.ultradns.biz, .com, .net, .org). DNS resolves to 172.65.201.65, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The site presents an HTTP 200 response and serves a Sectigo Limited / Sectoro Public Server Authentication CA DV R36 certificate, indicating a valid TLS handshake. The page title returned by the server reads “ManBetX(万博体育)官网|英超狼队和水晶宫全球赞助伙伴”, which does not reference Google, suggesting the front‑end content is unrelated to the claimed brand. Technology fingerprints reveal a Node.js runtime with the Express framework, jQuery UI, jQuery, HSTS, Google Analytics, Baidu Analytics, and GoCache. Security telemetry shows the domain is listed on two public blocklists (PhishDestroy, PhishingDB), has a Gridinsoft trust score of 0 / 100, a Scamadviser score of 1 / 100, and 18 of 95 VirusTotal scanners flag the host as malicious. The intelligence categorises the activity as a tech‑support scam, although the exact payload or victim‑interaction flow has not been observed. Defenders should treat cn.135manx.com as high‑risk: block DNS resolution and HTTP/HTTPS traffic at perimeter devices, add the IP address 172.65.201.65 to deny lists, and monitor for any outbound connections to the listed analytics endpoints. Continuous re‑scanning of the host and periodic review of blocklist status are advised to capture any changes in the infrastructure or payload delivery method.