dpkg[.]wujialin[.]dpdns[.]org

Analysis of the domain dpkg.wujialin.dpdns.org indicates a high-risk brand impersonation operation targeting China Central Television (CCTV). The domain was registered on March 13, 2025, through Gandi SAS and currently resolves to the IP address 172.67.148.119, hosted on Cloudflare's network (AS13335) in the United States. Nameservers are provided by digitalplat.org, a pattern often associated with malicious infrastructure. The page title, 海外频道_央视网(cctv.com), explicitly references CCTV's overseas channel, reinforcing the impersonation claim. Infrastructure analysis reveals the use of Cloudflare for hosting and CDN services, alongside Alibaba Cloud CDN, which may complicate takedown efforts or attribution. The SSL certificate is issued by Google Trust Services (WE1), a common but not exclusive indicator of legitimacy, as certificates are routinely obtained for malicious domains. The domain is actively blocked by two security blocklists, including PhishDestroy and PhishingDB, and holds a trust score of 1/100 from Scamadviser and 0/100 from Gridinsoft, further supporting its classification as malicious. At the time of assessment, the domain returns an HTTP 200 status, confirming it is operational. While 19 of 95 security vendors on VirusTotal flag the domain as malicious, this detection rate should be interpreted cautiously, as it reflects vendor-specific heuristics rather than definitive proof of intent. The exact content or functionality of the site remains unanalyzed, but the combination of brand impersonation, recent registration, and low trust scores provides sufficient evidence to classify this domain as a high-risk threat. Defenders are advised to block the domain at the DNS or network level, monitor for related subdomains or IP associations, and alert users to the impersonation risk. Given the use of Cloudflare and Alibaba Cloud CDN, further investigation into the hosting provider's abuse channels may be warranted to disrupt the infrastructure.