dqwhuhijivivnv[.]cc

PhishDestroy identifies dqwhuhijivivnv.cc as an active generic phishing domain, currently under investigation for its role in credential harvesting campaigns. The domain does not impersonate a specific brand, suggesting a scattergun approach to luring victims. Infrastructure analysis reveals a Let's Encrypt SSL certificate and resolution to IP 188.114.96.3, indicating a low-effort but potentially effective setup designed to bypass early-stage detection filters.

Technical indicators for this domain are as follows: VirusTotal shows 0 detections out of 95 engines, demonstrating its fledgling status in threat intelligence feeds. The domain was registered through Dynadot Inc, with a creation timestamp of April 16, 2026. It resolves to IP 188.114.96.3, which may be associated with previous malicious activities pending further correlation. Notably, Google Safe Browsing (GSB) has not yet flagged the domain, and no entries appear in public blocklists, reinforcing its emergent threat profile.

The domain remains active and unflagged, indicating a window of opportunity for threat actors to exploit unsuspecting users. Immediate action includes updating DNS sinkholes and firewall rules to block 188.114.96.3, while monitoring for downstream phishing kits or further infrastructure expansion. The current risk level is classified as under investigation, but the lack of detections and rapid domain age amplifies the urgency for proactive defense. Users should avoid interacting with this domain entirely until definitive remediation is confirmed.