admin[.]dqotz[.]cfd

This domain, admin.dqotz.cfd, has been identified as a credential theft phishing site targeting corporate or administrative login portals. Analysis indicates the infrastructure was designed to harvest user credentials by mimicking legitimate authentication interfaces, a common tactic in targeted phishing campaigns. No direct association with a specific brand or cryptocurrency drainer kit has been confirmed, though the domain structure suggests an intent to deceive users into entering sensitive login details under false pretenses. Infrastructure analysis reveals the domain was registered on July 22, 2025, through Global Domain Group LLC, a registrar frequently observed in malicious domain registrations. The domain resolved to the IP address 45.135.237.73, a host previously linked to other phishing and malware distribution activities. At the time of assessment, Google Safe Browsing classified the domain under the SOCIAL_ENGINEERING category, while VirusTotal reported detections from 14 out of 95 security vendors. The domain appeared on a single security blocklist, indicating limited but confirmed malicious activity. The domain is currently offline, having been taken down following detection and blocking by security systems. Despite its inactive status, residual risk remains due to the potential reuse of the underlying infrastructure or registration patterns by threat actors. Organizations are advised to monitor for similar domains registered through the same registrar or resolving to the identified IP address. Users should verify the authenticity of login portals before entering credentials, particularly those with unusual top-level domains or subdomains mimicking administrative interfaces.