qwse[.]lowcy[.]live

PhishDestroy identifies an active phishing campaign targeting unsuspecting users via the domain qwse.lowcy.live, which impersonates legitimate login interfaces to harvest credentials.

This domain exhibits elevated risk factors, confirmed by 1 out of 95 VirusTotal security vendors flagging it. Resolving to IP 172.67.185.115, qwse.lowcy.live operates under a Let's Encrypt SSL certificate, a common tactic to lend false legitimacy to phishing sites. While specific creation date and blocklist status remain unverified in public sources, the domain's low detection rate suggests it is either newly deployed or carefully evading standard filters. Trust scores are further diminished by its reliance on shared hosting infrastructure, a known vector for malicious activity.

To mitigate exposure, users should avoid interacting with this domain entirely and report it to their security teams or browser vendors. Organizations must implement DNS-level blocking for this domain and IP address, as well as educate employees on recognizing credential-harvesting phishing attempts. Immediate takedown requests should be submitted to hosting providers and registrars, leveraging the 1/95 VirusTotal detection as supporting evidence to accelerate the process.