quickbooks[.]to

This domain, quickbooks.to, was registered on 2026-04-04 through a registrar listed as the Government of Kingdom of Tonga. The authoritative name servers are ns0.1984.is, ns1.1984.is, ns1.1984hosting.com, ns2.1984.is, and ns2.1984hosting.com, and the A record resolves to 158.94.209.181, an address attributed to Omegatech LTD in the Netherlands. The site presents a valid TLS certificate issued by Let’s Encrypt (R12), and HTTP requests return a 200 status code. The page title observed is “Understanding Double-Entry Bookkeeping — DevSecure Docs,” which does not match the domain name and suggests the content is being used to lure victims. Intelligence sources classify the activity as credential phishing; the domain appears on three public blocklists and has been cited in one AlienVault OTX pulse. VirusTotal scans show 14 of 91 security vendors flag the domain, and Gridinsoft assigns a trust score of 0/100, indicating a high confidence of malicious intent. The evidence points to an active phishing campaign that likely harvests login credentials for accounting or financial services, though the exact target brand is not disclosed in the available data. Uncertainty remains regarding the specific phishing page layout, credential collection mechanism, and any associated command-and-control infrastructure. Defenders should add the domain and its resolving IP to blocklists, monitor DNS queries for the listed name servers, and consider sinkholing the address to disrupt traffic. Users should be warned not to enter any credentials on sites presenting the observed page title, and any compromised accounts should be reset immediately. Ongoing collection of payload samples and request logs is recommended to refine detection rules.