df[.]dsy[.]qpbmt[.]cn

Analysis of df.dsy.qpbmt.cn shows that the domain was registered on 29 December 2025 by 成都飞数科技有限公司. It resolves to the IPv4 address 154.201.95.12 and uses the authoritative name servers ns1.judns.com and ns2.judns.com. VirusTotal records indicate that one out of ninety‑one scanned security vendors flagged the domain as malicious, supporting its classification as a generic phishing site.

The domain is presently listed on three public blocklists and is actively blocked by the phishing mitigation services PhishDestroy, MetaMask, and SEAL. The risk level is rated high and the domain remains active as of the report date, 26 July 2026. No public evidence of SSL certificates, HTTP response codes, page titles, or additional OSINT feeds such as OTX or Safe Browsing has been disclosed.

The observable infrastructure therefore points to an active threat host with limited publicly visible attributes beyond the blocklist entries. Defenders should add both the fully qualified domain name and its resolving IP address to network deny lists, enforce DNS sinkhole rules, and monitor for any outbound connections to the host. Continuous re‑evaluation is recommended in case further indicators—such as malicious payload hashes, victim reports, or expanded blocklist coverage—appear.