jtrqwrher[.]lol

The domain jtrqwrher.lol was registered on 25 March 2026 through NameSilo, LLC. It is currently active and resolves to the IP address 188.114.97.3, which is hosted by Cloudflare, Inc. The authoritative nameservers are mark.ns.cloudflare.com and kehlani.ns.cloudflare.com. The site presents a TLS certificate issued by Let’s Encrypt (E7), indicating the use of a free, automated certificate.

A request to the web server returns HTTP status 403, and the only page title observed is “Just a moment…”. The domain appears on a single security blocklist and has been flagged by PhishDestroy. In the VirusTotal data set, one out of ninety‑five security vendors has marked the domain as malicious, and AlienVault OTX lists it in one threat‑intel pulse. The Gridinsoft trust score of 0 / 100 reinforces the low reputation of the infrastructure.

These observable artifacts collectively align with the classification of generic_phishing, and the high risk rating reflects the likelihood that the site is used to harvest credentials or deliver malicious payloads. However, the limited number of detections (one vendor flag, one blocklist entry) and the lack of publicly disclosed payload samples leave the exact phishing campaign details uncertain. No additional content analysis beyond the page title is currently available.

Defenders should add jtrqwrher.lol and its underlying IP 188.114.97.3 to deny‑list controls, enforce DNS filtering, and monitor for any resolution changes. Continuous re‑evaluation of VirusTotal and threat‑intel feeds is advised, as additional detections may emerge. Blocking the associated Cloudflare nameservers would disrupt the domain’s resolution, but may affect other legitimate services sharing the same provider.