qfsbackuppro[.]com

The domain qfsbackuppro.com is a confirmed phishing site engaged in brand impersonation targeting the cryptocurrency platform Across. It operated as a seed-phishing and wallet-connect phishing scam, presenting itself as a 'Secure Digital Asset Backup & Staking Platform' to deceive users into connecting wallets or entering sensitive credentials. As of the latest verification, qfsbackuppro.com has been taken offline, though prior activity posed an elevated risk to users.

Technical indicators confirm the malicious nature of qfsbackuppro.com. The domain was flagged by 2 of 95 VirusTotal security vendors, including Bfore.Ai PreCrime and Gridinsoft, which assigned it a trust score of 0/100. It appeared on 4 security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Registered through Cosmotown, Inc. on July 05, 2025, the domain resolved to the IP address 146.0.225.250, hosted by velia.net Internetdienste GmbH in Germany. The SSL certificate was issued by Let's Encrypt / R12, and the site utilized technologies such as particles.js, Bootstrap, LiteSpeed, and jQuery.

Users who interacted with qfsbackuppro.com should immediately revoke any token approvals granted to the site and transfer funds to a new wallet to prevent potential theft. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the domain to relevant platforms, including the impersonated brand Across, and submit it to additional blocklists or security vendors such as Google Safe Browsing to aid in mitigation efforts.