zxgdvj[.]cn

This domain is flagged as a high-risk credential harvesting phishing site. Analysis indicates the infrastructure was specifically designed to deceive users into submitting sensitive authentication details through fraudulent login portals, despite currently displaying a 403 Forbidden error. The threat type aligns with generic phishing campaigns targeting personal and corporate credentials. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain zxgdvj.cn was registered on May 21, 2025 through 包头市特木鲁网络科技有限公司, a registrar frequently associated with suspicious domains. It resolves to IP address 104.21.59.150, hosted by a content delivery network in Canada, which is commonly used to obscure origin servers. Security telemetry shows 17 out of 95 detection engines on VirusTotal flagged this domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist and was blocked by PhishDestroy. Notably, the site lacks SSL encryption, increasing the risk of credential interception during transmission. Mitigation requires immediate action from both end users and network administrators. Users who may have visited zxgdvj.cn should assume credential compromise and initiate password resets for all accounts accessed from the same device or network. Multi-factor authentication should be enabled where available to mitigate account takeover risks. Network administrators should add the domain and its resolving IP 104.21.59.150 to web filtering systems and monitor for connections to this infrastructure. Given the domain's recent creation date and current offline status, organizations should remain vigilant for similar domains registered through the same registrar or resolving to the same IP range, as these may represent follow-on campaigns from the same threat actor.