web3qlitexvault[.]com

Analysis of web3qlitexvault.com indicates an active investment‑type phishing operation first observed after the domain was registered on February 21 2026 through Dynadot LLC. The site presents an HTTP 200 response and serves content over a Let’s Encrypt certificate (R13), confirming that TLS is in use but offering no indication of legitimate ownership. Infrastructure tracing shows the domain resolves to 78.40.143.67, an address located in Bulgaria and associated with AS45839 (Shinjiru Technology Sdn Bhd), a hosting provider frequently leveraged for malicious campaigns. DNS is delegated to Cloudflare nameservers leonidas.ns.cloudflare.com and linda.ns.cloudflare.com, a common pattern for fast‑flux or obfuscation. The page title returned is "about:privatebrowsing," a value that does not correspond to any legitimate site and suggests intentional misdirection.

Detected technologies include LiteSpeed web server, Alpine.js front‑end framework, Smartsupp live‑chat widget, and HTTP/3 support, indicating a fairly modern stack. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on four security blocklists. VirusTotal scans show six of ninety‑three security vendors flag the domain as malicious, reinforcing the suspicion. Blocklist providers PhishDestroy, Polkadot, Enkrypt, and Codeesura have already listed the domain, evidencing community consensus of its threat status.

Uncertainty remains regarding the exact phishing landing page content and any credential‑harvesting mechanisms, as the page title does not reveal functional details. Defenders should block the domain and its resolving IP at perimeter defenses, monitor for outbound connections to the host, and consider adding the domain to internal threat‑intel feeds. Continuous re‑evaluation is advised, given the active status and recent registration date, to detect any evolution of the campaign.