qpiohyqysg[.]click

On July 23, 2026 analysts observed that the domain qpiohyqysg.click was taken offline but retains artifacts that indicate a gaming‑related impersonation campaign. The site resolved to the IP address 172.67.219.88, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. Registration records show the domain was created on November 08, 2024 through the registrar Sav.com, LLC, and is served by the Cloudflare nameservers brodie.ns.cloudflare.com and norah.ns.cloudflare.com. No TLS certificate was presented for the domain, suggesting that HTTPS was not configured at the time of observation.

The page title returned by the web server was "Roblox," aligning with the listed scam type of a gaming scam and indicating that the adversary likely attempted to lure victims by mimicking the popular Roblox platform. Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of credibility. VirusTotal scans recorded 13 detections out of 95 security vendors, providing independent confirmation of malicious intent. The domain appears on one external security blocklist and has been referenced in fifteen AlienVault OTX threat‑intel pulses, demonstrating that it has been shared among the broader security community.

PhishDestroy has actively blocked the domain, further evidencing its classification as a malicious resource. While the site is no longer reachable, its historical footprint suggests a short‑lived infrastructure used to target gamers. Defenders should continue to monitor for any resurgence of the same IP address or associated Cloudflare nameservers, enforce outbound filtering for requests to the domain, and update detection rules to include the observed indicators of compromise, including the domain name, IP address, and lack of TLS. Organizations with Roblox‑related user bases should educate users about unsolicited links and encourage verification of URLs before credential entry.