cpo[.]qeb[.]temporary[.]site

On 24 July 2026 analysts observed that the domain cpo.qeb.temporary.site resolves to the IPv4 address 162.144.4.212, which is hosted by AS46606 Unified Layer in the United States. The domain was registered on 21 February 2026 through eNom, Inc., and uses the authoritative nameservers ns1.temporary.site and ns2.temporary.site. An HTTPS service is present, secured by a Let’s Encrypt R12 certificate, indicating a recent TLS deployment. HTTP requests to the host return a 503 Service Unavailable status, while the page title reported by crawlers is “403 Error”, suggesting that the server intentionally blocks access or that the content has been removed.

The web server identifies itself as Apache HTTP Server. VirusTotal scans show that 20 of 95 security vendors have flagged the domain as malicious, and the domain is listed on a single external blocklist. Operationally, the domain has been taken offline and is currently blocked by the PhishDestroy mitigation platform. The overall risk rating is elevated, and the threat type is classified as generic phishing.

Evidence confirms the infrastructure components but no payload, credential‑stealing page, or targeted brand information is available from the current scan. Consequently, the exact phishing campaign details, such as victim lure or credential collection mechanisms, remain uncertain. Defenders should continue to block the domain at DNS and network layers, monitor for any resurgence of the IP address or similar sub‑domains, and update intrusion detection signatures to reflect the observed Apache server fingerprint and the Let’s Encrypt certificate thumbprint. Ongoing vigilance is advised, especially for any traffic directed to the temporary.site namespace, as the registrar and hosting environment have been used in prior malicious campaigns.