qaventro[.]com

qaventro.com was registered on 23 February 2026 through NiceNIC International Group Co., Limited. The site’s sole visible indicator is the page title “Qaventro — Faster, better, stronger than your average crypto exchange”, which suggests an investment‑focused cryptocurrency offering. The domain resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was observed, indicating that the service was served over plain HTTP. The authoritative name servers are johnathan.ns.cloudflare.com and katja.ns.cloudflare.com, both Cloudflare‑managed, confirming the hosting provider.

The domain appears on a single public blocklist, PhishDestroy, and has been flagged by two of ninety‑three VirusTotal scanners, reinforcing the suspicion of malicious intent. The blocklist entry classifies the activity as an investment scam, aligning with the page title and the generic phishing categorisation supplied. The site’s current status is taken offline, which limits immediate interaction but does not remove the underlying infrastructure. Evidence gaps remain: the specific payload, credential‑harvesting mechanisms, and any associated command‑and‑control infrastructure have not been publicly disclosed. No additional reputation scores, Safe Browsing verdicts, or open‑source intelligence references were provided.

Consequently, defenders cannot confirm the full scope of the threat beyond the observed indicators. Recommendations: security operations should block outbound connections to 188.114.96.3 and to the Cloudflare name servers listed, enforce TLS‑only policies to prevent accidental clearance of unencrypted traffic, and add qaventro.com to internal URL filtering lists. Continuous monitoring of the domain’s registration and any re‑appearance on blocklists is advised.