qtradedirectinvestment[.]com

This domain, qtradedirectinvestment.com, is flagged as a high-risk phishing site impersonating Qtrade Direct Investment, a legitimate financial services platform. Analysis indicates the threat type is brand impersonation, specifically targeting users through a fake login portal designed to harvest credentials. The page title, 'Qtrade Direct Investment • Home,' directly mimics the legitimate brand, increasing the likelihood of successful social engineering attacks. No evidence of a crypto drainer kit or direct malware deployment was observed, though credential theft remains the primary objective. Technical indicators confirm the domain's malicious infrastructure. VirusTotal reports 1 of 95 security vendors flagging qtradedirectinvestment.com as malicious. The domain was registered through HOSTINGER operations, UAB, on June 23, 2026, an anomalous future date suggesting potential registration data manipulation. It resolves to the IP address 198.251.84.200, and employs a Let's Encrypt SSL certificate to appear legitimate. Google Safe Browsing (GSB) status is currently unlisted, and no additional blocklist entries were identified beyond the single VirusTotal detection. The domain's creation date discrepancy further indicates an attempt to evade detection or analysis. As of this report, qtradedirectinvestment.com remains active and unblocked by most security vendors. Immediate response actions should include blacklisting the domain and IP address 198.251.84.200 across enterprise security tools, as well as monitoring for credential reuse attempts from harvested data. Despite the low detection rate, the domain's active status and brand impersonation tactics pose a significant risk to end users. Organizations are advised to implement DNS-based blocking and educate users on recognizing phishing indicators, such as mismatched URLs, suspicious SSL issuers, and anomalous registration details.