zoomspace[.]cn

zoomspace.cn was registered on 27 February 2024 through 北京新网数码信息技术有限公司. The domain resolves to 172.232.112.221, an address announced by AS63949 Akamai Connected Cloud and geolocated to India. Authoritative name servers dns7.expirenotification.com and dns8.expirenotification.com are observed, both of which are frequently associated with domains that abuse expiration‑notification mechanisms. An HTTP 301 redirect is returned and the site presents no SSL certificate, meaning all content is delivered over clear‑text HTTP.

Two of ninety‑five security engines on VirusTotal have flagged the domain, and three independent blocklists—PhishDestroy, MetaMask, and SEAL—currently list it. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low‑reputation assessment. The page title captured during analysis, "域名注册_域名查询_域名购买_域名申请_新网," mirrors the registrar’s marketing language and suggests the site may be masquerading as a legitimate domain‑registration portal to entice victims.

The classification as generic phishing is supported by the observed infrastructure and the lack of encryption, but the specific phishing lure, credential‑harvesting forms, or targeted brand have not been publicly captured. The domain remains active as of the report date and is assigned a high risk level, reflecting the combination of a low trust score, multiple blocklist listings, and the presence of infrastructure commonly leveraged for credential‑stealing campaigns.

Defenders should block zoomspace.cn at perimeter firewalls and DNS resolvers, and actively monitor outbound connections to the resolved IP address 172.232.112.221. Adding the associated name servers to sinkhole or remediation feeds can disrupt future abuse. Continuous reconnaissance is advised to detect any changes in hosting, certificate deployment, or content that could indicate a shift in the attack vector.