qfsledgerx[.]org

The domain qfsledgerx.org was registered on 15 September 2025 through Dynadot Inc. It is currently resolved to the IPv4 address 104.21.54.129 and is served by Cloudflare DNS using the authoritative nameservers leia.ns.cloudflare.com and miguel.ns.cloudflare.com. VirusTotal analysis shows that a single security vendor out of ninety‑one submitted detections has flagged the domain, indicating at least one independent observation of malicious activity. The domain is listed on a security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that threat‑intelligence feeds consider it hostile.

The threat classification attached to the infrastructure is “crypto drainer,” suggesting the site is used to lure victims into transferring cryptocurrency to addresses controlled by threat actors. No public information is available regarding the site’s SSL certificate, HTTP response codes, page title, or any associated malware families, leaving the exact delivery mechanism and victim interaction unknown. The infrastructure appears to be hosted on a Cloudflare edge network, which can obscure the underlying web server location and complicate takedown efforts.

Defenders should add qfsledgerx.org to URL filtering and domain‑allowance exclusion lists, monitor DNS queries for the domain and its associated Cloudflare nameservers, and enforce outbound transaction controls for cryptocurrency transfers. Network traffic to the IP 104.21.54.129 should be logged and, where feasible, blocked. Continuous re‑evaluation is advised, as additional detections or changes in hosting could alter the risk profile.