benqi[.]cc

The domain benqi.cc was registered on 21 February 2026 through Immaterialism Limited. It is currently active and resolves to the IPv4 address 37.27.135.61, which belongs to the Hetzner Online GmbH data centre in Finland (AS24940). The authoritative name servers are 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo, all hosted by the njalla service. An HTTPS connection to benqi.cc presents a low‑trust certificate identified as R12, and the web server returns HTTP status 200. The landing page title is simply “Benqi”, matching the domain name and suggesting an attempt to mimic a legitimate brand. Gridinsoft assigns a trust score of 31 out of 100, indicating a high likelihood of malicious intent. The site is classified as a brand‑impersonation campaign targeting multiple brands, listed under the generic target “across”. It is tagged as a seed_phish operation and has been added to the PhishDestroy blocklist, with one additional security blocklist reference. VirusTotal analysis shows two out of ninety‑five scanners flagging the domain as malicious, reinforcing the suspicion. Defenders should proactively block DNS resolution for benqi.cc and any subdomains, enforce TLS inspection to capture the malicious payload, and consider sinkholing the associated IP address. Continuous monitoring of the njalla name servers is advised, as the infrastructure could be repurposed for other campaigns. At present, the content observed is limited to the generic “Benqi” landing page; further payloads may be delivered after user interaction.