bobiqianbaoappmianfeixiazaigw[.]com[.]cn

Analysis of bobiqianbaoappmianfeixiazaigw.com.cn shows a newly registered domain (created May 24, 2026) that is actively hosting a crypto‑drainer campaign. The site resolves to IP 154.194.142.165, which is registered to Starbow Ltd in Hong Kong. The server runs Nginx with HSTS enabled and serves content built on Bootstrap; the TLS certificate is issued by Let’s Encrypt (E8). HTTP responses return status 200, indicating the site is reachable and serving pages. The page title, "波币钱包APP免费下载 - 安全便捷的数字货币支付及C2C交易撮合," advertises a free cryptocurrency wallet app, matching the declared scam type of a crypto drainer. Reputation signals are extremely poor: Gridinsoft assigns a trust score of 0/100, AlienVault OTX lists the domain in one threat pulse, and VirusTotal flags the domain in 18 of 91 security engines. The domain is already listed on one public blocklist and has been blocked by PhishDestroy. Registration was performed through Web Commerce Communications Limited, but no further infrastructure details such as ASN are available. Defenders should prioritize immediate blocking of the domain and its resolving IP at perimeter firewalls and DNS filtering solutions. Because the site serves over HTTPS, TLS inspection should be enabled to allow deeper inspection of inbound and outbound traffic. Monitoring for any outbound connections to the IP address or similar patterns of crypto‑wallet download requests can help detect compromised hosts. Given the lack of additional infrastructure data, continuous threat‑intel enrichment is advised to capture any future pivoting or additional assets associated with this campaign.