qevorinex[.]com

qevorinex.com is an active credential‑phishing site first registered on 28 April 2026. The domain is hosted behind Cloudflare, Inc., using the nameservers betty.ns.cloudflare.com and razvan.ns.cloudflare.com and resolves to IP 172.67.140.31, which is geolocated to Canada. The site presents a valid TLS certificate issued by Let’s Encrypt (E8) and enforces HTTP Strict Transport Security; traffic is delivered over HTTP/3. A simple HTTP GET returns status 200 and the page title “Qevorinex”, matching the observed content.

Technical analysis classifies the payload as generic credential phishing, and the risk level is marked high. The Gridinsoft trust score for the domain is 0 / 100, indicating extreme distrust. VirusTotal has flagged the domain in 10 of 95 scanned security engines. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. These indicators demonstrate that multiple security platforms have identified the site as malicious.

Open questions remain regarding the specific credentials targeted, the phishing kit employed, and any downstream command‑and‑control infrastructure. No malware samples or redirects have been publicly disclosed, and the site’s content appears limited to a static landing page. Consequently, attribution of the campaign to a particular threat actor or group cannot be confirmed at this time.

Defenders should block DNS resolution for qevorinex.com and any associated IP address 172.67.140.31 at the perimeter and endpoint layers. URL filtering rules should be updated to flag the exact page title “Qevorinex” and the Let’s Encrypt/E8 certificate fingerprint. Continuous monitoring of Cloudflare name server changes is advised, as the operator may pivot to new IPs. Sharing these indicators with threat‑intelligence feeds will help accelerate detection across the community.