# PhishDestroy threat dossier — quantumworldledgernanox.site ================================================================ Fetched: 2026-04-24 20:16:35 UTC Canonical: https://phishdestroy.io/domain/quantumworldledgernanox.site/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 82/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Ledger ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/94 security vendors flagged this domain Flagging vendors: Forcepoint ThreatSeeker, Seclookup ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 147.93.93.186 (FR, Paris) ASN: AS47583 Hostinger International Limited Hosting org: Hostinger International Ltd. Registrar: NameSilo, LLC !!! REGISTRAR INTEGRITY ALERT — NameSilo !!! NameSilo is a registrar documented by PhishDestroy as (1) publicly lying about received abuse reports, (2) shielding a $20M+ Monero-theft operation (xmrwallet.com) for 10 continuous years, and (3) retaliating against PhishDestroy by getting our X/Twitter account @Phish_Destroy banned after we published the evidence. Researchers/victims must ALWAYS CC compliance@icann.org on every abuse ticket — NameSilo has a track record of later claiming reports were never received. Primary sources: https://phishdestroy.io/namesilo-killed-our-twitter https://phishdestroy.io/xmrwallet-namesilo-exposed Nameservers: ["ns1.dns-parking.com", "ns2.dns-parking.com"] Registered: 2026-04-21 Page title: 403 Forbidden ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-06-06 Status: INVALID chain Fingerprint: 3d3e393a345d5c00081f44608f0290f3b1a58fbef4b0a0a2ff51d55de525b33c Subject Alternative Names (related infrastructure — often same operator): - www.quantumworldledgernanox.site ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-21 13:24:26 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-04-21 10:25:29 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-04-23 13:40:05 UTC Neutralised: 2026-04-22 00:27:53 UTC Current status: taken down (registrar suspended or DNS dead) Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019daf91-347f-72ec-b3c4-78f6286802df/ URLQuery: https://urlquery.net/report/7652048e-0e64-4fe6-8422-f4475b1c248c Wayback Machine: https://web.archive.org/web/*/quantumworldledgernanox.site crt.sh CT logs: https://crt.sh/?q=%25.quantumworldledgernanox.site Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=quantumworldledgernanox.site AlienVault OTX: https://otx.alienvault.com/indicator/domain/quantumworldledgernanox.site URLhaus: https://urlhaus.abuse.ch/host/quantumworldledgernanox.site/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-21 13:24:50 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies quantumworldledgernanox.site as an active brand impersonation domain targeting Ledger users. The site poses as the legitimate Ledger platform to deceive visitors into revealing sensitive information or transferring cryptocurrency to attacker-controlled wallets. Ledger is a well-known hardware wallet provider, and threat actors frequently abuse its reputation to distribute crypto drainers or steal credentials under the guise of technical support or software updates. This domain was flagged by PhishDestroy on July 09, 2025, the same day it was registered through NameSilo, LLC. It resolves to IP address 147.93.93.186 and holds a valid Let's Encrypt SSL certificate, which increases its credibility to unsuspecting users. Security vendor detection remains low, with only 1 out of 95 engines on VirusTotal currently identifying the domain as malicious. This highlights the sophistication of the threat, as low detection rates often correlate with higher success rates for cybercriminals. If you visited quantumworldledgernanox.site, do not enter any credentials, download any software, or connect a hardware wallet. Disconnect from the internet if you suspect unauthorized access and scan your device using reputable antivirus software. Report the domain to your security team or platform, and avoid interacting with any links or pop-ups on the site. Always verify URLs and use official Ledger channels for support. Consider revoking any API keys or permissions granted to unknown domains and monitor your cryptocurrency wallets for unauthorized transactions. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260421-537CB9 Favicon MD5: 027f06ba70a445bc425e3200e398a60b TLS cert SHA-256: 3d3e393a345d5c00081f44608f0290f3b1a58fbef4b0a0a2ff51d55de525b33c ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/quantumworldledgernanox.site/ JSON API: https://api.destroy.tools/v1/check?domain=quantumworldledgernanox.site Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io