quanminqianbaoappxiazaianzhuang[.]com[.]cn

This domain, quanminqianbaoappxiazaianzhuang.com.cn, is actively engaged in credential theft targeting users of Chinese digital payment platforms. Analysis of the page title and content indicates an attempt to impersonate a legitimate mobile application download portal for a widely used digital wallet, likely aiming to harvest login credentials or distribute malicious APK files. The domain remains operational as of the latest verification, posing a high risk to unsuspecting users seeking to download financial applications. Infrastructure analysis reveals the domain was registered on March 24, 2026, through Web Commerce Communications Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 154.194.138.57, hosted in Hong Kong by Starbow Ltd, an infrastructure provider commonly linked to malicious activity. The domain is flagged by 15 of 95 security vendors on VirusTotal, and it appears on one security blocklist. A Let's Encrypt SSL certificate (serial number E8) is deployed, providing a superficial layer of legitimacy to deceive users. The page title, encoded in UTF-8, explicitly references a "全民钱包APP下载安装" (Quanmin Wallet APP download and installation), reinforcing the credential theft objective. Current status indicates the domain remains active and accessible, with no signs of takedown or mitigation. Organizations and users are advised to block the domain and its resolving IP at the network perimeter. Endpoint protection solutions should be updated to detect and prevent access to this domain. Users who may have interacted with the site should immediately reset credentials for any financial accounts accessed from the same device. Financial institutions are recommended to monitor for anomalous login attempts originating from devices that visited this domain. Proactive threat hunting should be conducted to identify any secondary payloads or command-and-control infrastructure associated with this campaign.