app-feiji[.]com[.]cn

The domain app-feiji.com.cn is identified as a generic phishing resource targeting users through brand impersonation of Telegram, specifically its Chinese-language client. Analysis confirms the domain is currently offline, though prior activity presented it as an official download portal for the messaging platform. The page title, 纸飞机官网 - 纸飞机中文版下载, directly translates to "Paper Airplane Official Website - Paper Airplane Chinese Version Download," where "Paper Airplane" is a known colloquial reference to Telegram in Chinese-speaking regions. Infrastructure analysis reveals the domain was registered through Dynadot Inc on May 8, 2026, an anomalous creation date suggesting potential manipulation or misconfiguration. It resolved to the IP address 188.114.97.3, a Cloudflare-associated endpoint, and employed security technologies including HSTS, HTTP/3, and a Let's Encrypt SSL certificate. Detection metrics indicate 15 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared on a single blocklist prior to takedown. The domain was also actively blocked by PhishDestroy, reinforcing its classification as a phishing threat. Current status confirms app-feiji.com.cn has been taken offline, though the infrastructure and registration details remain of investigative interest. Users who accessed the domain prior to deactivation should assume credential exposure or malware delivery occurred. It is recommended to revoke any credentials entered on the site, scan affected devices for malicious payloads, and monitor for unauthorized account activity. Organizations should update blocklists to include the domain and associated IP, while security teams may analyze the Cloudflare-resident infrastructure for related threats. The anomalous registration date warrants further scrutiny to determine if the domain was part of a larger campaign or an isolated incident.