e807c71c2041acb94821918bbf7651[.]gqlki[.]cn

Analysis indicates that the domain e807c71c2041acb94821918bbf7651.gqlki.cn was registered on 2025-05-17 through the registrar 商中在线科技股份有限公司. The authoritative name servers leland.ns.cloudflare.com and natasha.ns.cloudflare.com resolve the domain to the Cloudflare edge address 104.21.22.28, which is geolocated to Canada and associated with Cloudflare, Inc. The host advertises HTTP/3 support but presents no TLS certificate, leaving the connection unencrypted. Threat intelligence flags the domain as a generic phishing site. It appears on one security blocklist and has been explicitly blocked by the PhishDestroy filtering service.

VirusTotal analysis shows that 7 out of 94 scanned security vendors have generated detections for the domain, confirming malicious activity. The Gridinsoft trust score is 0 out of 100, indicating a high confidence of abuse. The domain is currently listed as offline, suggesting that the malicious infrastructure has been taken down or is no longer serving content. Despite these indicators, no public page title, brand target, or payload details have been released, so the exact phishing campaign vectors remain unknown.

Defenders should continue to block any resolution of the domain at the network perimeter, enforce DNS sinkholing for the associated IP address, and monitor for any resurgence of the domain or its aliases. Continuous re‑evaluation of threat feeds is advised, as additional detections may emerge if the actors reactivate the site. The lack of TLS and the low trust score further justify strict deny‑list policies for this host.