zero2oneaccounting[.]com[.]au

Analysis of zero2oneaccounting.com.au indicates a high-risk credential-phishing domain targeting Chinese-speaking users. The domain was registered through Tucows (Australia) Pty Ltd trading as OpenSRS and currently resolves to IP 66.102.128.13, hosted by HostPapa in Canada. Nameservers ns1291.websiteservername.com and ns1292.websiteservername.com are configured, and the site presents an HTTP 200 status, confirming active hosting. The page title, '中信会计事务所 – 一家帮您赚钱的事务所' (translated: 'Zhongxin Accounting Firm – An Accounting Firm That Helps You Make Money'), suggests a lure targeting individuals seeking financial or accounting services, though no specific brand impersonation is confirmed from available data. Infrastructure analysis reveals the domain is flagged on one security blocklist (PhishDestroy) and appears in a single AlienVault OTX threat intelligence pulse. Sixteen of 91 security vendors on VirusTotal detect the domain as malicious, though the exact nature of the threat (e.g., phishing kit, redirect chain, or malware hosting) remains unconfirmed without deeper inspection. The SSL certificate is issued by Let’s Encrypt (YR1), a common choice for both legitimate and malicious sites, providing no definitive classification on its own. Defenders should treat this domain as actively malicious due to its presence on blocklists, confirmed phishing classification, and targeting of sensitive credentials. Network-level blocking at the IP (66.102.128.13) and nameserver level is recommended, alongside monitoring for connections to the domain in logs. Given the Chinese-language lure and accounting theme, organizations with Chinese-speaking users or financial-sector exposure should prioritize awareness and technical controls. Further investigation into the phishing kit or payload is warranted if user reports or additional telemetry emerge.