pqpvb[.]loan

Analysis indicates that the domain pqpvb.loan was registered through Dynadot LLC on February 21, 2026. The authoritative nameservers ns7.alidns.com and ns8.alidns.com resolve the domain to the IPv4 address 182.16.48.99, which belongs to AS45753 Netsec Limited and is geolocated in Hong Kong. An HTTPS endpoint is presented using a Let’s Encrypt R12 certificate, confirming the presence of TLS but offering no additional trust. A request to the root URL returns HTTP status code 200 and delivers a page whose title is "新澳门葡京445.com", which aligns with the reported scam type of an investment scheme.

The hosting environment is identified as Alibaba Cloud Object Storage Service, a common platform for malicious actors to host static content. The domain appears on a single security blocklist and has been flagged by the PhishDestroy service, indicating that at least one anti‑phishing feed has already taken mitigation action. Reputation scoring from Gridinsoft assigns a zero‑out‑of‑hundred trust score, reflecting a lack of observed benign activity. VirusTotal analysis shows that two of ninety‑five scanned security vendors have raised detections against the domain, providing additional independent confirmation of malicious intent.

The combination of a recent registration date, low reputation score, active blocklist entry, and detection by multiple vendors suggests that the domain is being used for fraudulent investment phishing. Defenders should consider adding pqpvb.loan to network‑level deny lists, enforce DNS sinkhole redirects, and monitor outbound connections to the associated IP address. Continuous re‑evaluation is advised, as the threat actor may update the payload or change hosting infrastructure, but current evidence strongly supports treating the domain as high‑risk and actively malicious.