ex[.]asrobot[.]cn

The domain ex.asrobot.cn is currently active and classified as a high‑risk generic phishing site that impersonates a cryptocurrency exchange. The site presents a page titled “exchange‑panel” and serves content over HTTPS using a Let’s Encrypt R12 certificate. Front‑end components were identified as Vue.js running on an Apache HTTP Server, indicating a modern web‑app façade designed to lure victims into entering credentials. Infrastructure analysis shows the domain resolves to IP 47.104.180.25, hosted in China by Aliyun Computing Co., Ltd. The authoritative name servers are dns21.hichina.com and dns22.hichina.com, both associated with the Alibaba Cloud registrar. The domain was created on 07 Jun 2018 through 阿里云计算有限公司（万网）. The SSL certificate is valid and automatically renewed, reducing obvious security warnings. Gridinsoft’s trust score is 0 / 100, and the host appears on three public blocklists. Threat intelligence feeds have flagged the domain on PhishDestroy, MetaMask, and SEAL blocklists, confirming its use in credential‑stealing campaigns targeting exchange users. VirusTotal scans report 13 of 95 security vendors flagging the host, reinforcing the malicious assessment. HTTP requests return a 200 status, indicating a fully operational web service. No additional indicators such as malware payloads or command‑and‑control endpoints have been observed, leaving the exact phishing kit and victim outreach methods uncertain. Defenders should immediately block ex.asrobot.cn at the network perimeter and add it to email‑security deny lists. Monitoring for outbound connections to the IP 47.104.180.25 can reveal compromised hosts. Security teams should update user awareness material to reference the “exchange‑panel” façade and advise users to verify TLS certificates and URL spelling before entering credentials. Ongoing surveillance of the associated name servers and any new sub‑domains is recommended to catch future iterations.