vo-youdao[.]com[.]cn

vo-youdao.com.cn is currently listed as a high‑risk generic phishing site. The domain, created on 15 June 2026 and registered through 万商云集（成都）科技股份有限公司, resolves to the IPv4 address 94.154.43.8. The IP is geolocated to Turkey and is associated with the individual identified as FOP Danik Vyacheslav Evgenievich. The site serves HTTP 200 responses and presents a page titled “有道翻译官网 – 皓智AI翻译软件下载 | 智能翻译工具”, which mimics the official Youdao translation service, indicating a targeted credential‑stealing campaign. The web server is identified as Nginx with HTTP Strict Transport Security (HSTS) enabled, and the TLS certificate is issued by Let’s Encrypt (YR2). Nameservers ns1.kenpains.com and ns2.kenpains.com resolve the domain, providing no obvious affiliation with the legitimate Youdao brand. The certificate’s issuance date aligns with the domain’s creation, suggesting the infrastructure was provisioned specifically for the phishing operation. VirusTotal scans show that 3 out of 95 security vendors flag the domain as malicious, and the site appears on a single public blocklist, currently blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, reinforcing the assessment of a malicious payload. The page content, language, and branding are crafted to lure Chinese‑speaking users into downloading a counterfeit AI translation tool, a classic lure for credential harvest. Defenders should add the domain and its resolving IP address to network deny lists, enforce DNS sink‑hole policies for ns1.kenpains.com and ns2.kenpains.com, and monitor TLS logs for connections to the Let’s Encrypt‑issued certificate. Incident response teams should treat any credential submissions to the site as compromised, advise affected users to reset passwords, and consider sharing the indicators of compromise with threat‑sharing platforms to improve collective detection.