What Gridinsoft observed on qckl.net
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261014192534-83d74c8c
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Inconclusive
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent review did not reproduce malware or phishing on the accessible operator pages. It could not establish the broader service’s commercial and financial integrity or resolve the delivery dispute. The existing Suspicious classification remains unchanged because this review does not establish a contradictory Safe conclusion; this is not a finding of proven malware or fraud.
Analyst findings
Review 7 documented observations View evidence
The accessible homepage, hosting catalog, company information and terms describe hosting, servers and IP resources. Reviewed navigation and local scripts showed ordinary menus, attribution, analytics and chat integration; no harmful download, unrelated forced redirect or credential-stealing behavior was reproduced.
- Public artifact URL https://qckl.net/
- Public artifact URL https://qckl.net/hosting.php
- Public artifact URL https://qckl.net/offer.php
- Analyst observation The terms identify QCKL Network Solutions IBC and describe a conditional 30-day refund request with processing within 45 working days. Corporate registration and actual refunds were not independently verified.
The hosting link reached the related control-panel subdomain. NVMe Basic configuration and cart showed EUR 1.99 monthly, matching the advertised price. The checkout requested name, email and a new account password and offered cryptocurrency payment options. No information, order or payment was submitted, and payment handling or service delivery was not tested.
- Public artifact URL https://ctrl.qckl.net/
- Analyst observation The observed configuration, cart and checkout remained on ctrl.qckl.net. No unrelated credential recipient or automatic download was observed.
An archived first-party contract from 21 March 2025 stated a USD 4900 minimum investment, 50% of net server profit with at least USD 300 monthly from month 6, and a two-year term. The original URL now returns 404; the current invest.php page contains ordinary partner contact information without that return offer. Actual payouts and financial backing were not verified.
- Public artifact URL https://web.archive.org/web/20250321014327/https://qckl.net/invest-agreement.html
-
HTTP status
404 - Public artifact URL https://qckl.net/invest.php
A 12–14 October 2026 public dispute concerns a dedicated-server order allegedly replaced by a VPS and contested promotion terms. A provider-style account acknowledges substitution but disputes the bonus claim. Account authorship and transaction records were not authenticated. Earlier consumer allegations and anonymity/complaint-tolerance advertising are context, not reproduced malware or proven fraud.
- Public artifact URL https://searchengines.guru/ru/forum/1147625
- Public artifact URL https://www.trustpilot.com/review/qckl.net
- Public artifact URL https://forum-seo.net/threads/qckl-net-abuzoustoichivyye-vydelennyye-servery-ot-eur9-99-bez-verifikatsii.30373/
Exact-host and parent-domain searches covered public indexes, URL scanners, sandboxes and threat intelligence. URLScan returned no accessible results within its imposed 30-day window; OTX returned no pulses, URL entries or malware objects. VirusTotal’s public interface exposed no current verdict data, and URLhaus access was denied. The refreshed Gridinsoft public report lists ESET Suspicious. No exact-target harmful URL/sample or behavioral trace was established.
- Public artifact URL https://urlscan.io/search/
- Public artifact URL https://otx.alienvault.com/indicator/domain/qckl.net
- Public artifact URL https://www.virustotal.com/gui/domain/qckl.net
- Analyst observation ThreatFox, URLhaus, ANY.RUN and Tria.ge index searches yielded no independently verifiable exact-target harmful artifact. The refreshed report lists ESET Suspicious as a domain warning; the separate forum claim of ESET SCAM was not independently authenticated.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/qckl-net
Selected September 2025 and May 2026 archived root pages show hosting catalogs. The September snapshot advertised physical servers only; that historical statement does not verify any individual order. Static archive inspection did not identify a malware sample; archived scripts were not executed.
- Public artifact URL https://web.archive.org/web/20250912114059/https://qckl.net/
- Public artifact URL https://web.archive.org/web/20260510071053/https://qckl.net/
qckl.net is already the registrable parent domain. Its apex resolved to 159.195.27.176. The exact www.qckl.net alias returned NXDOMAIN, so no live www content was reviewed. An exact archive availability query returned no www snapshot; this is not proof that none ever existed. Other subdomains and customers’ domains or leased infrastructure are separate scopes.
- DNS fact qckl.net A 159.195.27.176; www.qckl.net NXDOMAIN
- Analyst observation No customer-controlled qckl.net namespace was established by this review; hosting services alone do not prove such delegation.
Scope and limitations
- This assessment covers the recorded public pages and pre-submission order flow. No account, purchase, payment, delivered server or authenticated customer environment was tested.
- Historical financial promises, payouts, corporate registration and disputed transactions were not independently authenticated or audited. Historical content is not presented as a current offer.
- Public scanner and archive coverage was limited. No live www content or unrelated subdomain, customer website or leased IP infrastructure is certified by this review.
Help protect others by sharing this page on social media! The more people who know about qckl.net, the fewer chances they have to deceive someone else. Help others evaluate qckl.net by sharing this page on social media!