aqknyozl[.]4qiuj[.]com

The domain aqknyozl.4qiuj.com is identified as a credential theft operation designed to harvest user login credentials through deceptive web forms. Analysis indicates the site is currently offline, though it remains a documented threat in security databases. No legitimate brand impersonation has been confirmed, but the infrastructure aligns with credential harvesting campaigns targeting unsuspecting users. Infrastructure analysis reveals the domain was registered on March 26, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 154.82.96.107, hosted on AS399077 (Tcloudnet) in the United States. Security vendors on VirusTotal flagged the domain in 18 of 95 scans, and it appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E8), provides encryption but does not validate legitimacy, as malicious actors commonly exploit free certificate authorities. Current status confirms the domain has been taken offline, reducing immediate exposure. However, the infrastructure remains a documented threat, and similar domains may reemerge under different names. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on critical accounts, and monitor for unauthorized access. Organizations should block the domain and its associated IP at the network level to prevent potential exposure. Security teams are encouraged to review logs for connections to 154.82.96.107 or related subdomains to assess compromise.