qwervty[.]com

Analysis of qwervty.com, created on November 28, 2025 and currently active, shows multiple indicators of malicious intent. The domain is hosted behind Cloudflare infrastructure, using nameservers aida.ns.cloudflare.com and sonny.ns.cloudflare.com, and resolves to the IPv6 address 2606:4700:3031::6815:17e4, which belongs to AS13335 Cloudflare, Inc. in the United States. An SSL certificate issued by Google Trust Services (WE1) is present, but the certificate alone does not guarantee legitimacy. HTTP traffic returns a 301 redirect, and the page title observed is "Otoñoubs," which provides no clear context about the site’s purpose.

The registrar listed is Gname.com Pte. Ltd., a common registrar for disposable or short‑lived domains. Reputation data shows the domain appears on two independent blocklists—PhishDestroy and ScamSniffer—both of which classify it as a phishing or scam resource. AlienVault OTX references the domain in one threat‑intelligence pulse, reinforcing its association with malicious activity. VirusTotal scans have flagged the domain, with nine out of ninety‑five security vendors reporting detections, indicating that automated tools have identified suspicious behavior.

Technologies detected include Cloudflare’s HTTP/3 support, which is typical for fast‑moving malicious operators seeking performance and anonymity. While the exact payload or credential‑harvesting technique has not been publicly disclosed, the convergence of blocklist listings, OTX pulse, multiple vendor detections, and the use of a generic page title suggests a high‑risk phishing campaign. Defenders should block network connections to the domain and its associated IP range, add the domain to internal URL filtering and email security policies, and monitor for any outbound traffic that may attempt to contact the same Cloudflare‑hosted address. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to the domain’s infrastructure.