qoucrzk[.]life

On 23 July 2026 the domain qoucrzk.life was observed to host a generic phishing page. The site presented the title “qoucrzk.life” and did not serve an HTTPS certificate, indicating that traffic was unencrypted. DNS resolution returned the address 47.253.153.57, which is allocated to Alibaba Cloud (AS45102) in the United States. The authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net, both publicly associated with dynamic DNS services.

VirusTotal records show that fifteen of ninety‑five scanning engines flagged the domain, confirming a consensus of malicious classification across multiple vendors. AlienVault Open Threat Exchange lists the domain in sixteen separate threat‑intel pulses, and it appears on at least one external security blocklist. The domain was registered through Alibaba Cloud US, matching the hosting ASN, and no further registrar details were disclosed. Automated mitigation platforms, including PhishDestroy, have already taken the site offline, and current checks confirm the host is no longer reachable.

The evidence establishes a clear malicious infrastructure: a non‑TLS web endpoint, a cloud‑based IP address, and corroborating detections from independent reputation services. However, the content of the page, the targeted brand, and the phishing kit employed have not been publicly released, leaving the exact victim‑selection strategy unknown. Defenders should continue to block the IP 47.253.153.57 and the domain qoucrzk.life at network perimeter devices, update URL filtering and DNS sinkhole configurations, and monitor for any re‑registration of the domain or similar aliases under the same nameserver pair. Ongoing observation of VirusTotal and OTX feeds is recommended to capture any new indicators that may emerge if the adversary reactivates the campaign.