shanyongqianbao[.]com[.]cn

The domain shanyongqianbao.com.cn was registered on 24 May 2026 and is currently classified as a high‑risk generic phishing site. The public page presents a Chinese‑language interface titled “闪用钱包 - 安全便捷的数字钱包与移动支付平台”, which mimics a digital wallet and mobile payment service to lure victims into submitting credentials. The site resolves to the IPv4 address 154.194.138.51, which geolocates to Hong Kong and is owned by Starbow Ltd. Network services are provided by Nginx with HSTS enabled, and the front‑end uses the Bootstrap framework. The TLS certificate is issued by Let’s Encrypt (CN=E8), and the HTTPS endpoint returns HTTP 200 for the landing page. VirusTotal analysis shows that 15 of 95 scanned security vendors flag the domain as malicious, indicating partial detection across the ecosystem. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence. The domain appears on one public security blocklist and is listed in a single AlienVault OTX pulse. PhishDestroy has already blocked the domain, confirming active mitigation by at least one sink‑hole. Defenders should block DNS resolution to 154.194.138.51 and enforce URL filtering for the host name shanyongqianbao.com.cn. Because the site uses a valid Let’s Encrypt certificate and an HTTP 200 response, automated certificate‑based allowlists may not be sufficient; content‑inspection or heuristic detection of the page title and language cues is advised. Monitoring for additional domains registered by the same registrar or hosting provider may reveal further campaign expansion. Attribution remains uncertain beyond the observed infrastructure, and no additional payload or credential‑harvesting endpoints have been identified at this time.