930952[.]com

The domain 930952.com has been identified as a generic phishing site targeting users of an academic or question-and-answer portal, likely impersonating a Chinese-language service based on the page title encoding. Analysis indicates the domain is currently offline, though prior activity suggests it was designed to harvest credentials or distribute malicious payloads under the guise of a legitimate educational resource. Infrastructure analysis reveals the domain was registered on April 15, 2026, through Spaceship, Inc., and resolves to the IP address 104.21.50.209, hosted behind Cloudflare, Inc. infrastructure in Canada. The domain appears on one security blocklist and is flagged by 9 of 95 vendors on VirusTotal, indicating broad detection despite its recent creation. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing sites. The page title, encoded as DB视讯·(中国区)官方网站, translates to "DB Question · (China South) Navigation Website," further suggesting an attempt to mimic a regional academic platform. As of the latest assessment, 930952.com has been taken offline, though its infrastructure remains a potential vector for future malicious activity. Organizations are advised to block the domain and its associated IP (104.21.50.209) at the perimeter, monitor for residual DNS queries, and alert users who may have interacted with the site prior to its takedown. Security teams should review logs for connections to the domain or IP, particularly in environments where Chinese-language educational resources are accessed. Given the domain's recent registration and use of Cloudflare, additional related domains may emerge; proactive monitoring of newly registered domains with similar naming patterns is recommended.