gqdmvf[.]cc

On 12 June 2026 the domain gqdmvf.cc was registered through NameSilo, LLC. The authoritative DNS resolves to the single IPv4 address 188.114.97.3. VirusTotal has recorded detections from 13 of 91 submitted security scanners, indicating that multiple independent engines have identified malicious behavior associated with the domain. The domain is currently listed on one public security blocklist and has been explicitly blocked by the anti‑phishing service PhishDestroy, confirming that it is recognized as a phishing vector in operational defenses. The threat profile is classified as generic phishing with an elevated risk rating and the infrastructure remains active as of the report date, 29 July 2026.

Analysis of the available evidence shows a clear pattern of rapid domain acquisition followed by immediate deployment of malicious content, consistent with typical phishing campaign lifecycles. The limited detection footprint—only a single public blocklist entry—suggests that the malicious site may be employing short‑lived hosting or evasion techniques that keep it under the radar of broader community feeds. The IP address 188.114.97.3 is not known to be part of any reputable hosting provider’s clean network, but without additional contextual data it cannot be definitively linked to a larger malicious infrastructure. Defenders should prioritize the inclusion of gqdmvf.cc and its resolve IP 188.114.97.3 in network‑level deny lists, DNS‑based filtering, and endpoint protection signatures.

Continuous monitoring of the IP for new activity, as well as periodic re‑scanning of the domain on VirusTotal and other sandbox services, is recommended to capture any evolution of the payload or changes in hosting. Given the elevated risk rating, security teams should also consider raising alerts for any outbound connections to the domain and reviewing email traffic for indicators that reference gqdmvf.cc.