qp1111[.]vip

This domain, qp1111.vip, is identified as a generic phishing site designed to harvest user credentials through a fake login interface. The page title, displayed in Chinese as '登录' (Login), suggests targeting of Mandarin-speaking users, though no specific brand impersonation is confirmed. Analysis of the infrastructure reveals no direct ties to known crypto drainer kits or advanced phishing frameworks, but the presence of a basic credential capture mechanism aligns with opportunistic phishing campaigns. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on March 04, 2026, through Dynadot LLC, a registrar frequently exploited for malicious registrations. It resolves to the IP address 20.255.104.129, a host associated with prior phishing activity. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate, issued by Let's Encrypt (R12), provides no inherent trust, as it is commonly abused for short-lived phishing domains. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect its recent takedown rather than benign status. The domain is currently offline, likely due to takedown actions or infrastructure suspension. However, residual risk persists due to the registrar's history of hosting malicious domains and the potential for rapid redeployment under a new domain or IP. Users who interacted with the site should assume credential exposure and initiate password resets for any accounts accessed during the period of activity. Organizations are advised to monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors often reuse infrastructure across campaigns.