qfssbank[.]com

On July 24, 2026, qfssbank.com was identified as a brand‑impersonation site used for wallet/seed phishing. The domain was registered on 14 December 2024 through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to the Cloudflare address 104.21.70.84, which is announced by AS13335 Cloudflare, Inc. in the United States. DNS resolution is served by priscilla.ns.cloudflare.com and ram.ns.cloudflare.com. No TLS certificate is present, indicating that the site is delivered over plain HTTP. The page title returned by the live host is “Qfssbank - Home”, but the site has been taken offline at the time of analysis; its status is listed as offline.

Detection data show that the domain appears on four security blocklists and has been blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal recorded a single positive detection out of ninety‑five scanning engines. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious classification. The site is associated with the scam type “Wallet/Seed Phishing” and is reported to impersonate the brand “across”. The elevated risk rating reflects the potential for credential or seed phrase theft.

Because the infrastructure relies on a public Cloudflare edge node, attribution to a specific operator is limited. The lack of an SSL certificate, the low trust score, and the presence on multiple blocklists provide strong evidence of malicious intent, yet the exact phishing page content and any payload delivery mechanisms remain unverified, as the site is no longer reachable. Defenders should continue to block the domain at network perimeters, add the IP address 104.21.70.84 to deny‑list rules, and monitor for any re‑registration attempts. Regular updates from the listed blocklists and continued VirusTotal scans are recommended to capture any future re‑hosting of the same phishing kit.