vqnhkr[.]cam

The domain vqnhkr.cam has been classified as a high‑risk generic phishing site and remains active as of 12 July 2026. Registration data show the domain was created on 1 May 2026 and is hosted behind Cloudflare’s network, with the authoritative nameservers kim.ns.cloudflare.com and razvan.ns.cloudflare.com resolving to the IP address 188.114.96.3 located in Canada. The web service presents a valid HTTPS endpoint secured by a Let’s Encrypt certificate (issuer E7) and returns HTTP 200 responses. Fingerprinting indicates the presence of PHP and support for HTTP/3, confirming a modern web stack delivered through Cloudflare’s edge platform. The SSL certificate was issued after the domain’s creation, consistent with a rapid deployment typical of credential‑harvesting sites. Threat intelligence sources corroborate the malicious intent. VirusTotal reports that 2 of 95 scanned security vendors flagged the domain, and AlienVault OTX lists the domain in one pulse. The domain appears on three external blocklists and receives a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. Multiple independent blocklist feeds have already dropped the domain, indicating rapid community response. Open questions include the specific phishing campaign payload and the targeted brand, which have not been disclosed in public indicators. Defenders should block DNS resolution to 188.114.96.3 for the domain vqnhkr.cam, enforce HTTPS inspection to capture credential submissions, and monitor for any related sub‑domains or future registrations using the same nameserver pair. Continuous re‑evaluation is advised, as the infrastructure could be repurposed by the same operators.