qalvirexumbrateli[.]com

This domain, qalvirexumbrateli.com, is currently active and flagged as a high-risk credential phishing site. Registered on June 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, it resolves to IP address 172.67.178.42, hosted behind Cloudflare infrastructure in Canada. The page title, 'Qalvirex Umbrateli | Educazione Finanziaria e Panoramica dei Mercati,' suggests a focus on financial education or market overview content, though the exact nature of the phishing lure remains unverified due to lack of direct page analysis. Infrastructure analysis reveals the use of Cloudflare services, including Browser Insights and HTTP/3, alongside common frontend technologies such as Bootstrap and jQuery. The SSL certificate is issued by Google Trust Services (WE1), a typical configuration for malicious domains leveraging legitimate CDN services to evade detection. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse, indicating limited but confirmed malicious activity. One of ninety-one security vendors on VirusTotal has flagged the domain, though this single detection does not provide conclusive evidence of widespread recognition. The domain is blocked by PhishDestroy, and its Gridinsoft trust score is 0/100, further supporting its classification as malicious. Defenders should treat this domain as an active phishing threat, particularly given its recent registration and use of evasion techniques such as Cloudflare proxying. Monitoring for related infrastructure, including nameservers (rex.ns.cloudflare.com and tani.ns.cloudflare.com), may aid in identifying connected campaigns. Additional analysis of the site’s content is recommended to determine the specific phishing mechanism and target audience.