qq00[.]vip

qq00.vip is presently active and has been classified as a high‑risk generic phishing operation. The domain resolves to the IPv4 address 82.109.254.37, which is the sole A‑record observed. DNS interrogation returns four authoritative name servers (ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, ns4.domainname), indicating a multi‑server configuration that may be used to increase resilience. VirusTotal records show that five of ninety‑five scanning engines have flagged the domain as malicious, providing an early indication of suspicious activity despite a partial consensus among scanners. The domain is currently listed on one external security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing the assessment of malicious intent. No additional public intelligence such as SSL certificate details, HTTP response codes, page titles, or brand targeting has been disclosed, leaving the exact phishing payload and victim profile unverified. Given the confirmed activity, the presence on blocklists, and the partial VirusTotal detections, defenders should treat traffic to qq00.vip as hostile. Recommended actions include immediate network‑level deny rules for the resolved IP address, DNS sink‑hole or blocklist enforcement for the domain and its name‑server set, and continued monitoring of any new detections or changes in the domain’s hosting footprint. Analysts should also watch for future VirusTotal submissions that may raise the detection ratio, and consider sharing the indicator with internal threat‑intel platforms to aid correlation with potential credential‑harvesting campaigns.