zhizhu[.]space

Analysis of zhizhu.space, created on April 01, 2025 and registered through Go Daddy, LLC, shows a clear pattern of malicious infrastructure supporting a crypto‑related brand impersonation campaign. The domain resolves to IP address 128.241.227.221, which is assigned to AS213802 Tianfeng (Hong Kong) Communications Limited and geolocated to the United States. No TLS certificate is presented, indicating that any web traffic would be delivered over HTTP only, a common trait of low‑cost scam sites. The page title returned by the host is "Bitcoin," reinforcing the cryptocurrency focus, while the intelligence record lists the scam type explicitly as Crypto Scam and notes that the site impersonates the brand "across." VirusTotal scans have flagged the domain in 12 of 93 security vendors, demonstrating that a non‑trivial fraction of AV engines detect malicious activity associated with the host.

The domain appears on at least one public security blocklist and has been actively blocked by PhishDestroy, confirming that defensive communities have recognized it as abusive. Gridinsoft assigns a trust score of 0 out of 100, further indicating the absence of legitimate reputation. Nameservers ns27.domaincontrol.com and ns28.domaincontrol.com are standard GoDaddy resolvers, providing no additional mitigation benefit.

Although the site is currently taken offline, the underlying IP and hosting arrangement remain active and could be re‑used for future campaigns. Defenders should add zhizhu.space and its resolved IP 128.241.227.221 to blocklists, monitor for any re‑appearance of HTTP services, and ensure that outbound traffic to this address is denied. Continuous re‑evaluation of the domain’s status is recommended, as offline phishing infrastructure is frequently re‑hosted or redirected to new malicious payloads.