qirex[.]top

Analysis of the domain qirex.top indicates it was a credential-harvesting phishing site targeting Cloudflare users, operational in early 2026. The domain was registered on January 5, 2026, through Dynadot LLC and resolved to the IP address 172.67.171.123, which is part of Cloudflare's infrastructure (AS13335). This hosting choice is notable, as it leverages the same provider being impersonated, potentially increasing the perceived legitimacy of the phishing attempt. The domain was flagged by 17 of 93 security vendors on VirusTotal and appeared on the PhishDestroy blocklist, corroborating its malicious classification. Additionally, it was listed in one AlienVault OTX threat intelligence pulse, further confirming its association with phishing activity.

Infrastructure analysis reveals the domain used a low-trust SSL certificate (WE1), a common characteristic of hastily deployed phishing sites. The Gridinsoft trust score of 0/100 aligns with the domain's malicious classification. At the time of assessment, qirex.top was offline, suggesting either takedown by authorities or voluntary cessation by the threat actor. While the exact content of the phishing page is not analyzed, the domain's association with Cloudflare's IP range and its detection by multiple security vendors strongly indicate it was designed to harvest login credentials by mimicking Cloudflare's authentication portal. Defenders should treat this domain as confirmed malicious.

Network-level blocks should be implemented for the IP 172.67.171.123, and the domain should be added to enterprise blocklists. Organizations using Cloudflare services should alert employees to this specific threat, emphasizing the risks of credential harvesting via lookalike domains. Monitoring for similar domains registered through Dynadot or resolving to Cloudflare IPs may help preempt future campaigns.