qivzorun[.]top

The domain qivzorun.top was created on March 2, 2026 and is hosted behind Cloudflare’s network (AS13335). DNS resolution points to IP address 172.67.178.242, which is registered to Cloudflare, Inc. in the United States. The authoritative nameservers are hazel.ns.cloudflare.com and max.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar known to host a variety of short‑lived domains. No TLS certificate is presented for the site, indicating that HTTPS was not enabled at the time of observation. The only visible page element is the title tag, which reads “Qivzorun”, providing no additional context about the site’s purpose or targeted brand.

Security telemetry shows that three of ninety‑three VirusTotal scanners flagged the domain as malicious, and Google Safe Browsing categorises it as a social‑engineering threat. Independent blocklists from PhishDestroy, MetaMask, and SEAL have added the domain to their deny lists, and it appears on three additional security blocklists, reinforcing the consensus that the domain is being used for phishing. The current operational status is offline, which may be a temporary takedown or a deliberate shutdown after a campaign.

Analysis indicates that the domain’s infrastructure—Cloudflare hosting, rapid registration, lack of TLS, and minimal page metadata—is consistent with a typical generic phishing deployment. However, without live content or a captured payload, the specific phishing vector, targeted victims, or credential‑harvesting mechanisms remain unknown. Defenders should continue to block the domain and its resolved IP address at network perimeters, update intrusion‑detection signatures to include the observed hostnames and nameserver patterns, and monitor for any re‑registration attempts that reuse the same registrar or naming conventions.