tpqianbaoappguanfangxiazaigw[.]com[.]cn

Analysis of tpqianbaoappguanfangxiazaigw.com.cn shows a newly created domain (registered on May 24, 2026 through Web Commerce Communications Limited) that is actively serving a phishing page. The site returns HTTP 200 and presents the title "TP钱包APP官方下载 - 安全便捷的手机支付钱包工具", indicating a likely attempt to impersonate a financial application. The server uses a Let’s Encrypt certificate issued by the YE1 intermediate, and DNS resolves to 154.194.136.107, an IP located in Hong Kong and associated with Starbow Ltd. Nameservers a5.share-dns.com and b5.share-dns.net are publicly listed, confirming the domain’s operational infrastructure. The page is listed on at least one security blocklist and has been specifically blocked by the PhishDestroy feed, reinforcing the classification as a high‑risk generic phishing site. VirusTotal scans have flagged the domain in 17 of 95 security engines, and AlienVault OTX references it in a single threat pulse, providing additional corroboration of malicious intent.