rising-ai3[.]com[.]cn

Analysis of www.rising-ai3.com.cn shows the domain was registered on 25 July 2026 through 北京新网数码信息技术有限公司. The domain resolves to the IPv4 address 154.23.197.130 and is served by the authoritative name servers ns1.363.hk and ns2.363.hk. Within two days of creation it was added to at least one security blocklist and flagged by the PhishDestroy network, indicating that active phishing operations are already associated with the host. VirusTotal has recorded a single positive detection out of 91 scanned scanners, confirming that at least one anti‑malware engine has identified malicious behaviour linked to the domain.

The limited public telemetry means that additional attributes such as TLS certificate details, HTTP response codes, or page title have not yet been published. Consequently the full scope of the phishing campaign—targeted brand, credential‑capture method, or payload distribution—remains unknown. The presence of a dedicated Chinese registrar and the .com.cn TLD suggest a targeting of users in mainland China, but the IP address location and the .hk nameserver suffix also indicate possible use of hosting services in Hong Kong. Defenders should immediately add 154.23.197.130 to network‑level deny lists, block DNS resolution for www.rising‑ai3.com.cn and its two nameservers, and monitor outbound traffic for connections to the host.

Security appliances that integrate blocklist feeds should ensure the entry from PhishDestroy is activated. Continuous re‑scanning on platforms such as VirusTotal is advisable to detect any escalation in detection counts. Organizations that employ email filtering or web‑proxy solutions should treat any URLs containing the domain as malicious and quarantine related messages. Finally, incident response teams should gather any internal logs that reference the domain to ascertain whether credential theft or data exfiltration has already occurred.