shouzun[.]cn

Analysis of shouzun.cn indicates that the site was operating as a brand‑impersonation campaign targeting the TON ecosystem. The domain was registered on March 7, 2025 through 成都飞数科技有限公司 and resolves to the IPv4 address 154.212.241.174, which is geolocated to Hong Kong and announced by AS135097 LUOGELANG (FRANCE) LIMITED. HTTP requests returned a 200 status code and the page title "易欧 app下载安卓|权威数字货币平台，新手投资护航", suggesting an attempt to lure users interested in cryptocurrency applications. The TLS certificate presented on the host is issued to PhishDestroy / botadmin.destroy.tools, a known indicator of malicious infrastructure.

Reputation checks show a Gridinsoft trust score of 0 / 100 and VirusTotal recorded 12 detections out of 95 scanned engines, confirming that multiple security vendors have flagged the domain as malicious. The domain is listed on at least one public blocklist and has been actively blocked by the PhishDestroy mitigation platform. Nameserver records point to ns1.judns.com and ns2.judns.com, both of which are commonly observed in other malicious deployments. The current operational status is offline, with the domain taken down after detection.

However, the underlying hosting provider, IP range, and nameserver configuration remain active and could be reused for future campaigns. Defenders should immediately add shouzun.cn to blocklists across network perimeter and endpoint controls, monitor traffic to the associated IP address and ASN for any resurgence, and consider pre‑emptively restricting connections to the identified nameservers. Continuous ingestion of threat feeds that reference the same registrar and hosting profile is advised to catch sibling domains that may appear. Because only the page title and basic infrastructure have been observed, further content analysis was not possible; any additional payloads or credential‑collection mechanisms remain unknown and should be treated as high‑risk until proven otherwise.