qai46k[.]com

PhishDestroy has opened a case on qai46k.com after detecting it as a potential credential-harvesting phishing domain. At the time of writing, the site remains undetected by 95 VirusTotal engines, indicating it is slipping past current defenses. The domain was created yesterday, July 29, 2025, and is currently resolving to a Cloudflare IP (104.21.51.146) secured by a Google Trust Services SSL certificate, giving it a legitimate outward appearance while hiding its malicious intent. The investigation reveals that qai46k.com is likely mimicking a well-known login portal in order to trick visitors into entering their usernames and passwords. Threat intelligence shows the domain was registered through a privacy-protecting registrar (NICENIC INTERNATIONAL GROUP CO., LIMITED), a common tactic used by phishers to obscure their true identity and prolong the campaign’s lifespan. The site’s SSL certificate and recent creation date are being weaponized to create a false sense of security, tricking users into believing the page is genuine. If you have already visited qai46k.com, immediately change any passwords you may have entered on the site and enable multi-factor authentication on all related accounts. Scan your device with updated antivirus software to check for any follow-on malware installations. Report the domain to your IT administrator or through your browser’s built-in phishing reporting tool to help raise detection rates and protect others from this still-undetected threat. Do not re-enter any credentials on this domain and avoid clicking any links or downloading files from it in the future.