abpayqianbaoappguanfangxiazaigw[.]com[.]cn

Analysis indicates that the domain abpayqianbaoappguanfangxiazaigw.com.cn was registered on 23 May 2026 and currently resolves to the IPv4 address 154.194.137.70, which is geolocated to Hong Kong and associated with Starbow Ltd. The host presents a valid TLS certificate issued by Let’s Encrypt (identifier YE1) and serves HTTP 200 responses over an Nginx stack that includes Bootstrap and enforces HSTS. The page title returned by the server reads “ABPAY钱包APP官方下载 - 一站式数字钱包支付平台”, suggesting an attempt to masquerade as an official digital‑wallet application download page. The domain is classified as generic_phishing with a high risk rating and is listed as active. It has been blocked by the PhishDestroy blocklist and appears on one additional security blocklist. Reputation scoring from Gridinsoft rates the site at 0/100, and AlienVault OTX references the domain in a single threat pulse. VirusTotal analysis shows that 16 of 91 scanning engines flagged the host as malicious, reinforcing the phishing assessment. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no detailed content inspection has been shared. Defenders should treat any traffic to this host as hostile. Recommended mitigations include adding the domain and its resolving IP to deny‑list rules on perimeter firewalls, DNS filtering, and endpoint protection suites, monitoring for anomalous outbound connections to the IP, and ensuring users are educated about unsolicited prompts to download or install the ABPAY wallet application. Continuous re‑evaluation is advised as further indicators may emerge.