qonto-app[.]co[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Mastercard customers through credential harvesting. Analysis indicates the domain qonto-app.co.com was specifically designed to mimic Qonto bank login interfaces, presenting a fraudulent page titled 'Qonto login | The business account Qonto bank login | Qonto bank' to trick users into entering sensitive financial credentials. Infrastructure analysis reveals the domain was registered on February 21, 2026, and resolves to IP address 144.31.244.50 located in Germany under AS213877 (U1 DIGITAL SERVICES LTD). The domain appears on five security blocklists including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. VirusTotal detection shows 17 out of 95 security vendors flagging this domain as malicious. The SSL certificate is identified as R12, and the domain has since been taken offline. Mitigation requires immediate action from financial institutions and end users. Mastercard customers should be alerted to verify domain authenticity before entering credentials, particularly checking for subtle misspellings in URLs. Network administrators should implement DNS-based blocking of qonto-app.co.com and its associated IP 144.31.244.50. Security teams should monitor for credential reuse attempts from harvested logins and implement multi-factor authentication for all financial accounts. Financial institutions should proactively scan for similar impersonation domains using the creation date pattern and hosting provider characteristics identified in this case.