c[.]4qw[.]nl

Analysis of c.4qw.nl shows a high‑risk phishing infrastructure that remains active as of July 12 2026. The domain was registered on 14 February 2020 through Domeneshop AS and is delegated to the hyp.net nameserver cluster (ns1.hyp.net, ns2.hyp.net, ns3.hyp.net). DNS resolves to IP 45.154.232.28, which is hosted in Norway under AS44381 (ITsjefen AS). The web server reports Nginx with HTTP 200 responses and enforces HSTS; TLS is provided by a Let’s Encrypt R12 certificate. The sole visible page title is “Simulated phishing – README,” indicating a deliberate phishing lure. Reputation data is uniformly negative: Scamadviser scores 1/100, Gridinsoft 0/100, and 12 of 95 VirusTotal scanners flag the domain. The site is listed on two phishing blocklists, including PhishDestroy and PhishingDB. While the exact credential‑stealing payload or targeted brand is not disclosed, the combination of low trust scores, active blocklist listings, and confirmed HTTPS phishing page warrants immediate mitigation. Defenders should add the domain and its IP to network deny lists, monitor DNS queries for similar patterns, and educate users to avoid unexpected links referencing c.4qw.nl. Continuous re‑scanning is advised to detect any evolution of the payload or infrastructure.