mst-monex[.]huaweicloud1[.]cn

The domain mst-monex.huaweicloud1.cn was registered on July 17, 2023 through Web Commerce Communications Limited and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IP address 172.67.207.161, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. Both authoritative name servers are Cloudflare‑provided (gina.ns.cloudflare.com and rex.ns.cloudflare.com), and the site does not present an SSL certificate, returning an HTTP 503 status code at the time of observation. The page title captured from the site is the Japanese string "ログイン／マネックス証券", indicating that the content may be oriented toward a Japanese‑language audience, but no further page content has been disclosed.

Threat intelligence flags the domain as a brand‑impersonation campaign targeting Apple and classifies the activity as a tech‑support scam. The domain appears on a single security blocklist, PhishDestroy, and has been flagged by 14 of 95 security vendors on VirusTotal, suggesting moderate detection consensus. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment.

Given the combination of a reputable hosting provider used for anonymity, the lack of TLS, the unfavorable detection metrics, and the explicit impersonation of Apple, defenders should block any DNS resolution to the domain, add the IP address 172.67.207.161 to network deny lists, and monitor for any related command‑and‑control traffic. Incident response teams should also review logs for connections to Cloudflare‑hosted assets originating from internal hosts, particularly those attempting to retrieve resources that return a 503 response, as these may be indicative of automated probing of the malicious infrastructure. Continuous monitoring of the domain’s status and periodic re‑query of VirusTotal and blocklist feeds are recommended to capture any changes in activity or additional detections.