pekinshuho[.]com

The domain pekinshuho.com was registered on February 21, 2026 through West263 International Limited and currently resolves to the IPv4 address 160.202.253.246, which is allocated to AS146817 Hubei Feixun Network Co., Ltd in China. The site is served over HTTPS using a Let's Encrypt R12 certificate, and HTTP requests return a 200 status code, indicating the page is actively delivering content. The page title observed, "imtoken钱包app下载-imtoken官网安卓版下载-imtoken钱包正版下载|以太坊和比特币通用钱包," references a popular cryptocurrency wallet, suggesting the site is attempting to lure users interested in Ethereum or Bitcoin assets. Technical fingerprints show the presence of jQuery, HSTS, and Prism libraries, but no additional malicious scripts have been disclosed.

The domain is listed on three external security blocklists and has been flagged by three dedicated phishing mitigation services – PhishDestroy, MetaMask, and SEAL – reinforcing its classification as a phishing vector. On VirusTotal, twelve of ninety‑three scanning engines flagged the domain, providing further corroboration of malicious intent. AlienVault OTX records the domain in a single threat‑intel pulse, linking it to broader malicious activity tracking. Trust scoring from Gridinsoft assigns a zero‑out‑of‑one‑hundred rating, indicating an extremely high risk posture.

Nameserver configuration is distributed across six entries (ns1 to ns6 under the 363.hk domain), a pattern often seen in fast‑flux or evasive infrastructure. Defenders should block pekinshuho.com at DNS and proxy layers, monitor outbound connections to its IP, and incorporate the domain into threat‑intel feeds. Incident response teams should alert users to avoid any credential entry on the site, and SOC analysts should correlate logs for any attempted accesses originating from internal hosts. Continuous re‑evaluation is advised, as the active status and recent creation date suggest the campaign may evolve rapidly.