store-steampowered-zhcn[.]com[.]cn

Analysis of www.store-steampowered-zhcn.com.cn indicates that the domain is actively being used for phishing. The domain was registered on June 01, 2026 through the registrar 浙江贰贰网络有限公司 and resolves to the IPv4 address 154.91.90.242. DNS resolution is served by ns1.22.cn and ns2.22.cn. The domain appears on two reputable phishing blocklists, PhishDestroy and Phishunt, confirming that at least two independent security services have observed malicious activity associated with this host.

VirusTotal scans show that 7 out of 91 security vendors have flagged the domain, reinforcing the suspicion of abuse. No public evidence has been released regarding SSL certificate details, HTTP response codes, or page title content, so the current surface‑level characteristics of the web server remain unknown. The lack of additional contextual data such as Safe Browsing verdicts, OTX attribution, or trust‑score metrics means that defenders cannot rely on those signals for this specific host. However, the convergence of registration data, IP address, blocklist entries, and multiple vendor detections provides sufficient confidence to label the domain as high‑risk.

Organizations should block network traffic to 154.91.90.242 and prohibit DNS resolution of www.store-steampowered-zhcn.com.cn at perimeter defenses. Email gateways should be configured to flag any messages containing links to this domain, and endpoint security solutions should treat any attempted connections as malicious. Continuous monitoring of the domain’s DNS records and periodic re‑scans with VirusTotal or similar services are recommended to detect any changes in behavior or additional malicious payloads. Until further forensic detail becomes available, the domain should be treated as an active phishing infrastructure and excluded from trusted lists.