qyzdarlux[.]com

This domain is flagged as a high-risk credential theft phishing site, designed to harvest user login credentials under the guise of a localized escort service in Kazakhstan. Analysis indicates the domain employs social engineering tactics to deceive victims into submitting sensitive information, likely through fake login forms or fraudulent account verification prompts. Infrastructure analysis reveals the domain qyzdarlux.com was registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to IP address 104.21.76.98, a Cloudflare-hosted endpoint commonly used to obfuscate origin servers. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. The domain appears on one security blocklist and is flagged by 2 out of 95 security vendors on VirusTotal, with a page title of 'Qyzdar Lux — элитные проверенные спутницы в Казахстане,' targeting Russian-speaking users. Mitigation requires immediate blocking of the domain and its resolving IP (104.21.76.98) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) to endpoint detection systems, including the domain, IP, and SSL certificate thumbprint. User awareness training should emphasize the risks of credential submission on unverified platforms, particularly those using localized social engineering lures. Monitor for secondary infections, as credential theft often precedes account takeover or lateral movement in compromised environments.