qfsbackup[.]online

On 23 July 2026, threat intelligence sources reported activity associated with the domain qfsbackup.online. The domain was registered on 21 February 2026 and presently resolves to the IPv4 address 162.210.98.102, which is allocated to AS14555 LiquidNet US LLC located in the United States. At the time of capture the web server returned an HTTP response indicating the site was offline, but a page title of "1 new message" was observed, suggesting a minimal landing page. The content claims to impersonate the brand "scroll", and the campaign has been categorised as a crypto‑scam.

The TLS certificate presented for the domain received an R10 rating, while the Gridinsoft trust score is 0 out of 100, reflecting a lack of reputation. VirusTotal scanned the domain and recorded a single positive detection out of ninety‑three participating scanners. The domain is listed on four public blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple security vendors have taken remediation actions. The available evidence does not disclose the underlying phishing kit, the specific malicious payload, or any command‑and‑control infrastructure beyond the resolved IP address.

Consequently, defenders should treat any traffic to qfsbackup.online as hostile, enforce blocking at the network perimeter, and monitor the associated IP for any resurgence of activity. Additionally, organisations that utilise the "scroll" brand should educate users about the deceptive page title and reinforce verification of legitimate communications. Ongoing collection of HTTP headers, certificate details, and any newly observed redirects would help clarify the full attack chain if the site returns online.