qms-ai[.]net

This domain, qms-ai.net, is assessed as a confirmed phishing site targeting users through a fabricated Quality Management System (QMS) portal. Infrastructure analysis reveals the domain was registered on February 23, 2026, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. The site was taken offline prior to this assessment, though it remains a relevant indicator for retrospective threat hunting. No SSL certificate was present, increasing the likelihood of interception or manipulation of unencrypted traffic. The domain resolved to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic used to conceal the true origin of malicious infrastructure.

Nameservers elly.ns.cloudflare.com and yew.ns.cloudflare.com further confirm Cloudflare’s role in the domain’s DNS resolution. Detection data indicates limited but actionable intelligence: two of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The page title, 'QMS,' aligns with the phishing theme, suggesting the site was designed to impersonate a corporate or enterprise QMS login portal. No specific brand or organization is confirmed as the target, nor is there evidence of a known phishing kit or payload. The domain’s short lifespan—registered and subsequently taken offline within five months—is consistent with disposable phishing infrastructure.

Defenders should treat qms-ai.net as a confirmed malicious indicator. Recommended actions include blocking the domain and associated IP at perimeter security controls, reviewing logs for connections to 188.114.97.3 during the active period, and monitoring for related domains using the same registrar or Cloudflare nameservers. While the site is offline, historical traffic analysis may identify compromised accounts or internal reconnaissance activity.