connexion[.]shqs[.]click

Analysis of the domain connexion.shqs.click shows that it was registered on 21 November 2025 through NameSilo, LLC. The authoritative name servers are nadia.ns.cloudflare.com and rex.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to the IPv4 address 45.151.91.170, which belongs to AS209101 operated by Vendetta Inc. and is geolocated in Germany. No TLS certificate is presented for the host, meaning HTTPS connections are not available. The page title returned during the last HTTP request is “offsh.nl”, which does not correspond to the domain name and suggests possible content spoofing. Google Safe Browsing rates the site as a social‑engineering threat, and the domain appears on one public blocklist, specifically PhishDestroy.

VirusTotal scans have identified the domain as malicious in nine out of ninety‑five submitted security engines, reinforcing the classification as a generic phishing site. Additional reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, indicating a lack of confidence in the host. The absence of an SSL certificate means browsers will flag the connection as insecure, which can be leveraged by attackers to lure victims. As of the report date 24 July 2026 the domain is reported offline, but the hosting infrastructure remains observable and could be re‑activated.

At present no additional payload or credential‑harvesting page has been captured, so the exact phishing vector remains unknown. Defenders should continue to block the IP address 45.151.91.170 at perimeter defenses, enforce DNS filtering for the domain, and monitor for any re‑registration or resurrection of the host. Updating web‑gateway and email‑security policies to reject content originating from this domain or its associated IP range will reduce exposure. Ongoing threat‑intel feeds should be consulted for any new detection counts or additional blocklist listings.