rj-feiji[.]com[.]cn

This domain, rj-feiji.com.cn, operates as a fraudulent software distribution portal specifically targeting Chinese-speaking users. The site mimics an official download center for '纸飞机' (Paper Plane), a term commonly associated with Telegram clients in Chinese contexts. Analysis indicates the domain likely distributes trojanized or malicious software installers under the guise of legitimate applications, a tactic frequently used to deploy remote access trojans, cryptocurrency miners, or spyware. The page title '纸飞机中文官网 - 官方版下载中心' reinforces the false legitimacy, while the domain name itself incorporates a plausible brand variation to deceive users searching for authentic software sources. Technical evidence confirms the malicious nature of this infrastructure. VirusTotal detection shows 6 out of 95 security vendors flagging the domain as malicious, with specific classifications including 'phishing' and 'malware distribution.' The domain was registered through Dynadot Inc on May 9, 2026, an unusually future creation date that may indicate domain squatting or an error in registration records. Infrastructure analysis reveals the site was hosted behind Cloudflare (IP 172.67.163.121) and employed security features like HSTS and HTTP/3, likely to evade detection and appear more legitimate. The domain appears on at least one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft, further corroborating its malicious status. The SSL certificate issued by Let's Encrypt provides basic encryption but does not validate the site's legitimacy. Users who visited rj-feiji.com.cn or downloaded files from this domain should take immediate action to mitigate potential compromise. First, disconnect the affected device from the network to prevent further data exfiltration or command-and-control communication. Perform a full system scan using updated antivirus software to detect and remove any malicious payloads. If login credentials or personal information were entered on the site, reset passwords for all accounts accessed from the compromised device, prioritizing financial and email accounts. Monitor bank statements and credit reports for unauthorized activity, as malware distributed through fake software portals often includes keylogging or data-stealing capabilities. Consider reinstalling the operating system if persistent malware is detected, as some threats can survive standard removal procedures. Users should also report the domain to local cybersecurity authorities and their internet service provider to aid in broader threat mitigation efforts.