dd9d[.]qpon

Analysis on dd9d.qpon indicates the domain was created on 26 May 2025 and is presently taken offline. The domain resolves to IP 45.194.18.139, which is registered to AS137535 JT Telecom International Pte.Ltd. in Singapore. Registration was performed through Gname.com Pte. Ltd., and the zone is served by a single nameserver. No TLS certificate is present, meaning any HTTP connection would be unencrypted. The only visible artifact is the page title "ONLINE TRADING", suggesting an attempt to lure victims into a fraudulent trading service, although the site content has not been captured for further analysis.

Reputation services flag the domain as highly malicious. PhishDestroy lists it on its blocklist, and it appears on one additional security blocklist. Scamadviser assigns a trust score of 1/100, while Gridinsoft rates it 0/100, both indicating extreme suspicion. VirusTotal records show that the domain was scanned by 95 antivirus and URL‑reputation engines, none of which raised a detection at the time of scanning; this absence of alerts does not constitute evidence of safety.

The combination of low trust scores, blocklist inclusion, and the lack of a secure certificate reinforces the conclusion that the domain is being used for phishing‑related activity targeting users interested in online trading. Given the limited public surface, defenders should continue to block the domain and its associated IP address at perimeter filters and DNS resolvers. Monitoring for any re‑registration or activation of the domain is advisable, as threat actors may reactivate the host after a short downtime. Additional scrutiny of outbound traffic to the IP range owned by JT Telecom International is recommended to detect potential command‑and‑control or data‑exfiltration attempts that could be tied to this infrastructure.