cwqso[.]net

The domain cwqso.net was registered on May 14, 2026 through GoDaddy.com, LLC and is currently active. It is classified as a high‑risk generic phishing infrastructure, with three of ninety‑five VirusTotal scanners flagging the domain and a Gridinsoft trust score of zero. The domain resolves to 169.47.130.72, an IP owned by SoftLayer Technologies, Inc in the United States, and is served without an SSL certificate, returning HTTP status 200 for the default request.

Infrastructure analysis shows the zone is hosted on four Afraid.org name servers (ns1‑ns4.afraid.org), a common configuration for fast‑flipping or disposable domains. The lack of TLS and the recent creation date suggest a short‑lived deployment aimed at catching users before detection can be widely disseminated. The IP address belongs to a cloud provider frequently abused for malicious hosting, reinforcing the suspicion of a purpose‑built phishing operation.

Threat intelligence corroborates the malicious intent: the domain appears in one AlienVault OTX pulse, is listed on three external blocklists, and has been deliberately blocked by known defensive services such as PhishDestroy, MetaMask, and SEAL. These detections align with the observed HTTP 200 response and the absence of any legitimate certificate, indicating that the site likely hosts credential‑stealing pages or fraudulent login forms.

Defenders should immediately add cwqso.net to network and endpoint blocklists, monitor DNS queries for the four Afraid.org name servers, and consider sinkholing the associated IP range. Continuous scanning of the IP host for additional phishing payloads is advised, as the infrastructure may be reused for other campaigns. Given the high risk rating and active status, proactive containment is essential to prevent user credential compromise.