okpayguanfangxiazairukou[.]com[.]cn

The domain okpayguanfangxiazairukou.com.cn was registered on 24 May 2026 and currently resolves to the IPv4 address 154.194.138.42, which is geolocated to Hong Kong and associated with the Starbow Ltd network provider. The site presents a valid TLS certificate issued by Let’s Encrypt (E7), and an HTTP request returns a 200 OK status, indicating that the server is actively serving content. The page title returned by the web server is "OKPAY官方与下载入口 - 新一代安全数字支付钱包工具", which contains Chinese characters but provides no further contextual clues about the targeted brand or the nature of the credential collection page. The domain appears on a single security blocklist and has been flagged by PhishDestroy, confirming that at least one external sinkhole has taken action against it. Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, and the domain is referenced in one AlienVault OTX pulse. VirusTotal scans report that 16 of 91 security vendors classify the domain as malicious, reinforcing the observed risk. The current risk level is assessed as high, and the status remains active. Defenders should block DNS resolution to 154.194.138.42 for this domain, enforce TLS inspection to detect the Let’s Encrypt certificate, and monitor inbound traffic for any attempts to access the URL. Further investigation of the page content, once obtained, is required to determine the specific credential‑stealing mechanism and any additional infrastructure components.