gqtpzsrdeics[.]top

Analysis conducted on July 19, 2026, identifies gqtpzsrdeics.top as an active phishing domain exhibiting high-risk characteristics. The domain presents a page titled 'welcome!!', a generic but commonly observed indicator in credential-harvesting or initial-access phishing schemes. Infrastructure analysis reveals the domain is proxied through Cloudflare, resolving to IP address 172.67.220.126, which is geolocated in Canada under Cloudflare, Inc. Nameservers colin.ns.cloudflare.com and jewel.ns.cloudflare.com further confirm Cloudflare’s role in hosting the malicious infrastructure. The domain is registered through Spaceship, Inc., and uses an SSL certificate issued by Google Trust Services (WE1), a configuration frequently exploited to lend false legitimacy to phishing pages. Current detection data shows the domain is flagged by 18 of 91 security vendors on VirusTotal, indicating broad consensus among threat intelligence providers regarding its malicious nature. Additionally, the domain appears on one security blocklist and has been documented in three AlienVault OTX threat intelligence pulses, suggesting persistent or recurring phishing activity. Defenders should treat this domain as hostile. The HTTP 200 status confirms the page remains accessible, and the lack of takedown or sinkholing indicates continued operational use. While the exact brand or service being impersonated is not specified in available data, the 'welcome!!' page title and generic phishing classification suggest a likely attempt to harvest user credentials or distribute malware. Network-level blocking is recommended, alongside monitoring for connections to 172.67.220.126 or related Cloudflare-proxied infrastructure. Further analysis of page content or captured payloads may clarify the specific phishing campaign, but current evidence alone justifies immediate defensive action.