qevvax[.]courses

The domain qevvax.courses is currently active and flagged as a high-risk generic phishing threat targeting users of educational or course-related platforms. Analysis indicates the domain does not impersonate a specific brand but instead mimics a generic course portal, likely designed to harvest credentials or distribute malicious content under the guise of legitimate educational resources. The domain remains operational as of the latest verification, posing an ongoing risk to unsuspecting users. Infrastructure analysis reveals the domain resolves to the IP address 34.76.205.124 and was registered on February 18, 2026, through Sav.com LLC. Security vendors have flagged qevvax.courses as malicious, with 9 out of 95 VirusTotal engines detecting it as a threat. The domain appears on one security blocklist and lacks an SSL certificate, further indicating its suspicious nature. The page title, 'Index of /', suggests an exposed directory listing, which is atypical for legitimate educational portals and may be used to host phishing kits or malware payloads. Current status confirms the domain remains active and unmitigated. Organizations and individuals are advised to block access to qevvax.courses at the network level and update endpoint protection rules to include this domain. Users should be educated to recognize generic phishing tactics, particularly those leveraging educational themes. Security teams are recommended to monitor for connections to the associated IP 34.76.205.124 and investigate any related network traffic for signs of compromise or data exfiltration.