cyqershoke[.]com

Analysis of cyqershoke.com indicates active phishing infrastructure targeting users through a fraudulent exchange scheme. The domain was registered on March 27, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to 188.114.97.3, a Cloudflare-hosted IP address located in Canada. Nameservers alexia.ns.cloudflare.com and chase.ns.cloudflare.com further confirm Cloudflare as the DNS provider, a common tactic to obscure hosting origins and evade takedowns. The page title, written in Russian, translates to 'Innovative platform created for true enthusiasts of interactive competitive disciplines,' suggesting an attempt to lure users with promises of competitive or financial engagement. The site is explicitly classified as a fake exchange, though no specific brand impersonation is confirmed in available data. SSL certification is provided by Google Trust Services (WE1), a legitimate but frequently abused certificate authority in phishing operations. Security vendor detections are notable: 12 of 94 engines on VirusTotal flag the domain as malicious, while AlienVault OTX records its presence in eight threat intelligence pulses. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy. Detected technologies include Unpkg, AOS, and HTTP/3, which are not inherently malicious but are consistent with modern phishing kits designed for scalability and performance. Infrastructure analysis reveals no direct ties to known bulletproof hosting providers, though the use of Cloudflare complicates attribution. The domain remains active as of July 12, 2026, with a 200 HTTP status code, indicating operational phishing pages. Defenders should prioritize blocking the domain and its resolving IP, monitoring for related certificates (Google Trust Services/WE1), and investigating potential connections to other domains registered through the same registrar or using identical Cloudflare nameserver pairs.