iosyy[.]cn

The domain iosyy.cn was registered on 2024-03-22 through a Tencent Cloud service provider and resolves to the IPv4 address 115.159.59.75, which belongs to AS45090 operated by Shenzhen Tencent Computer Systems Company Limited. The authoritative nameservers are balsam.dnspod.net and thunder.dnspod.net, and the web server reports Nginx with HTTP Strict Transport Security enabled. The site presents a valid SSL certificate issued by ZeroSSL ECC Domain Secure Site CA.

Analysis classifies the site as a high‑risk generic phishing operation. The page title “小毅Max获取UDID” suggests an attempt to harvest device identifiers, a common technique for mobile‑app fraud. The domain appears in sixteen AlienVault OTX pulses, is listed on PhishDestroy and PhishingDB blocklists, and has been flagged by fifteen of ninety‑five VirusTotal scanners. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

Publicly available evidence stops at the page title and infrastructure metadata; no full page capture or malware sample has been released. Consequently, the exact user‑experience, credential collection method, or any downstream payload remain unknown. The lack of a disclosed target brand means the phishing lure may be generic or tailored to Chinese‑language mobile users, but the intent to obtain UDIDs is explicit.

Defenders should add iosyy.cn to network‑level deny lists and ensure DNS resolvers block the associated nameservers. Security appliances that rely on reputation feeds should treat the domain as malicious, given its presence on multiple blocklists and its zero trust score. Continuous monitoring of traffic to 115.159.59.75 and rapid sinkholing of the IP can limit exposure while further forensic analysis of the site content is conducted.