cpanel[.]qatarairways-contract[.]com

cpanel.qatarairways-contract.com is currently active and returns HTTP 200 responses. The domain was registered through INWX GmbH and resolves to the authoritative name servers ns19.truehostdns.com and ns20.truehostdns.com. It appears on one security blocklist and is listed as blocked by PhishDestroy, indicating that at least one mitigation service has taken action against it. VirusTotal scans have flagged the domain in eight out of ninety‑one AV engines, providing additional corroboration of malicious intent.

The combination of a high‑risk classification, active status, and detection by multiple independent sources suggests that the domain is being used for a generic phishing campaign, likely targeting users of Qatar Airways by exploiting the “cpanel” subdomain pattern to lend credibility. No public information about the underlying hosting IP, SSL certificate details, or page title is available in the supplied intelligence, leaving the exact content of the site unverified. Because the domain resolves and delivers HTTP content, it is capable of hosting malicious pages or redirecting victims to credential‑harvesting forms. Defenders should add the domain to firewall deny lists, DNS blocklists, and email filtering rules.

Continuous monitoring of the name servers and any changes to the DNS records is recommended, as attackers frequently pivot to new IP addresses while retaining the same domain. Incident response teams should also watch for related subdomains that share the same registrar or name‑server pair, as they may be part of the same infrastructure. The current evidence does not provide details on payloads or victim interaction, so further sandbox or manual analysis of the live page is required to confirm the phishing vector and to extract any indicators such as URLs, form fields, or embedded scripts.