zqtnd[.]cfd

zqtnd.cfd is an active domain that was registered on September 03, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the IPv4 address 188.114.96.3, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The TLS certificate presented is identified as “WE1”, and the HTTP response currently returns an empty page title consisting of a single period. The site is listed as offline at the time of analysis, but historical records indicate it was used for a Google‑impersonating tech support scam. The brand target is explicitly Google, and the scam type is cataloged as a tech support scam.

VirusTotal analysis shows that five of ninety‑three security vendors flagged the domain as malicious, reflecting a modest but non‑trivial detection rate. The domain is blocked by the PhishDestroy service and appears on one external security blocklist. Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent. No additional intelligence such as OTX tags or Safe Browsing entries is available in the current dataset.

Given the combination of a low trust score, partial vendor detections, and confirmed brand impersonation, the domain should be treated as elevated risk. Defenders are advised to add 188.114.96.3 to firewall deny lists, enforce DNS sink‑hole rules for zqtnd.cfd, and monitor for any future re‑activation of the domain or related subdomains. Continuous re‑scanning with VirusTotal and inclusion in internal threat‑intel feeds will help maintain visibility. Organizations that rely on Google services should educate users about unsolicited tech‑support calls and reinforce that Google never initiates support interactions via unsolicited email or phone.