ydbee[.]cn

The domain ydbee.cn is flagged as a high-risk active phishing threat. Registered on August 9, 2024, through Tencent Cloud Computing (Beijing) Co., Ltd., the domain remains operational as of July 12, 2026. It resolves to IP address 8.138.118.226, hosted in China on AS37963 (Hangzhou Alibaba Advertising Co., Ltd.), and uses nameservers vip3.alidns.com and vip4.alidns.com. The page title is '云端蜜蜂' (Cloud Bee), but the specific brand or service being impersonated is not confirmed from available intelligence. The site runs on Typecho, PHP, Nginx, and OpenResty, with client-side technologies including jQuery, jQuery-pjax, and Highlight.js, and enforces HSTS. SSL certificate is issued by Google Trust Services (WR1). MX records point to mx1.feishu.cn and mx2.feishu.cn, suggesting email handling through the Feishu platform. VirusTotal shows 2 out of 95 security vendors flagging the domain, and it appears on one security blocklist (PhishDestroy). Gridinsoft trust score is 0/100. The exact phishing lure or content type remains unverified, as no page source or visual analysis is available. Defenders should block the domain at network and email gateways, monitor for related subdomains or IPs, and investigate the Feishu MX association for potential email-based phishing campaigns. Since the site is still live, additional threat hunting for credential harvesting or data exfiltration endpoints is recommended.