qe[.]wwrkk[.]uk

Analysis of the domain qe.wwrkk.uk indicates an elevated-risk phishing infrastructure that was active until recently. The domain was registered on October 11, 2025, through Ionos SE and resolves to IP address 185.221.216.119, hosted on AS393960 (Host4Geeks LLC) in the United Kingdom. No SSL certificate is present, increasing susceptibility to interception. The HTTP response reveals a directory listing with the page title 'Index of /', suggesting an open or misconfigured web root rather than a polished phishing kit. This lack of content obfuscation may indicate a staging environment or a low-effort operation.

Detection data shows 11 of 95 security vendors on VirusTotal flagging the domain as malicious, and it appears on one security blocklist (PhishDestroy). The domain uses nameservers ns1.gargera.online and ns2.gargera.online, which may be part of a broader malicious DNS infrastructure. No brand target or specific phishing kit is identified from the available page title, so the intended victim or scam type remains unconfirmed. The domain is currently offline, reducing immediate exposure, but the hosting provider and registrar should be notified for potential takedown.

Defenders are advised to block the domain and its resolving IP (185.221.216.119) at the network level. If internal logs show connections to this domain, investigate for credential exposure or lateral movement. Given the directory listing and lack of SSL, this may have been used for payload delivery or as a temporary command-and-control endpoint. Further analysis of related domains under the gargera.online nameserver cluster is recommended to identify linked threats.