zhongshujuan[.]com

Analysis shows that zhongshujuan.com is currently hosting a page titled “中山市洛神教育咨询服务中心”. The site returns HTTP 200 and is secured with a Google Trust Services certificate issued under the WE1 tag, indicating a valid TLS connection. DNS resolution points to 172.67.133.159, an address owned by Cloudflare, Inc. in Canada, and the domain uses Cloudflare’s authoritative nameservers ian.ns.cloudflare.com and surina.ns.cloudflare.com. Registration was performed through Gname.com Pte. Ltd., a registrar commonly associated with disposable or privacy‑focused registrations. The domain appears in two AlienVault OTX pulses and has been added to at least one public phishing blocklist, with PhishDestroy confirming active blocking. VirusTotal scans have recorded detections by 20 of 91 security vendors, reinforcing the malicious classification. The current status is listed as active, and no further content analysis is available beyond the page title. Uncertainty remains regarding the exact phishing payload, target audience, and any credential‑harvesting mechanisms employed. Defenders should add the domain and its IP address to web‑filter and DNS block lists, monitor outbound connections to the associated Cloudflare IP range for anomalous activity, and consider sharing the indicator set with threat‑intelligence platforms. Continuous re‑scanning is advised to capture any changes in payload or hosting infrastructure.