# PhishDestroy domain threat record: worldqfslobstrledgerweb.co.uk Content language: English Canonical HTML report: https://phishdestroy.io/domain/worldqfslobstrledgerweb.co.uk/ Machine-readable companion: https://phishdestroy.io/domain/worldqfslobstrledgerweb.co.uk/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-11 02:57:35 UTC - Last availability or vendor check: 2026-10-21 01:15:59 UTC - Stored record updated: 2026-10-22 14:25:23 UTC - VirusTotal detections in the stored snapshot: 9/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Ledger ## Stored infrastructure - Observed IP address: 79.133.41.250 - Registrar in stored WHOIS data: Dynadot, LLC t/a Dynadot - Registrar country in stored WHOIS data: Unknown - Registration date (registry RDAP, worldqfslobstrledgerweb.co.uk): 2026-09-08 11:36:27 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a08e69-5fa8-71dd-b393-75c02bf9bd1c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/worldqfslobstrledgerweb.co.uk - Certificate Transparency search: https://crt.sh/?q=%25.worldqfslobstrledgerweb.co.uk - Web Archive lookup: https://web.archive.org/web/*/https://worldqfslobstrledgerweb.co.uk/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview worldqfslobstrledgerweb.co.uk is an impersonation phishing page that poses as Ledger, the hardware wallet maker, to target people who keep crypto on Ledger devices. PhishDestroy first flagged it on 2026-09-11, three days after the domain was registered. The site went offline on 2026-09-19 and its DNS was still inactive when we last checked on 2026-10-19. How the scam works Fake Ledger sites usually tell visitors that their device needs a firmware fix, a security check or a wallet sync. They then ask the visitor to type in the 24-word recovery phrase. Anyone holding that phrase can rebuild the wallet on their own hardware and empty it, and a stolen seed cannot be changed or revoked. Ledger never asks for a recovery phrase on any website. The page title, "Worldqfslobstrledgerweb - Home", is a generic placeholder that does not show the Ledger name, even though we classified the site as Ledger impersonation. Evidence Nine of 89 VirusTotal engines flagged the domain as of 2026-09-16. They include Kaspersky, BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, alphaMountain.ai and SOCRadar. That is a modest count, but it comes from several unrelated vendors. Beyond PhishDestroy, the domain is listed by the MetaMask and SEAL blocklists, which are both focused on crypto. Spamhaus DBL lists it as a spam domain, and four AlienVault OTX threat pulses reference it. Infrastructure The domain was registered through Dynadot on 2026-09-08 and detected three days later. It went dark eleven days after registration. That short lifespan is typical of disposable phishing domains, which are used briefly before blocklists catch up. The site was hosted on the Ultahost network at 79.133.41.250, a server located in Germany. It used a free Let's Encrypt certificate, so the padlock in the browser said nothing about whether the site could be trusted. What to do If you typed your Ledger recovery phrase into this site, treat the wallet as compromised. Set up a new device or a new seed, and move any remaining funds to it immediately. Do not reuse the old phrase anywhere. If you only browsed the page and entered nothing, no action is needed beyond staying alert to follow-up messages that use Ledger branding. Defenders should block the domain and IP 79.133.41.250 and watch for newly registered lookalike domains that combine "ledger" with random strings. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a08e69-5fa8-71dd-b393-75c02bf9bd1c/ VirusTotal report: https://www.virustotal.com/gui/domain/worldqfslobstrledgerweb.co.uk Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=worldqfslobstrledgerweb.co.uk Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:19:59 UTC ## Stored page captures - Primary capture: https://i.ibb.co/C5rfg22Q/a2e8c75a0408.png Captured: 2026-09-11 03:02:33 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a08e69-5fa8-71dd-b393-75c02bf9bd1c.png Captured: 2026-09-11 03:02:33 UTC Source report: https://urlscan.io/result/01a08e69-5fa8-71dd-b393-75c02bf9bd1c/ - URLScan capture 2: https://urlscan.io/screenshots/01a08a89-7cb7-772b-9afe-df244bf67348.png Captured: 2026-09-11 02:57:35 UTC Source report: https://urlscan.io/result/01a08e69-5fa8-71dd-b393-75c02bf9bd1c/ - URLQuery: https://screenshots.phishdestroy.io/uq/07a674d7-b6d3-4b63-aaf5-44d03d0551a5.png Captured: 2026-09-11 03:06:48 UTC Source report: https://urlquery.net/report/07a674d7-b6d3-4b63-aaf5-44d03d0551a5 SHA-256: f407fc7cd1a816cf1fec01224cb5f5756eab65739467e643b2fbc49856cc9ded - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f229a3d6-9ab5-4c6e-8bb2-29fa802b85b0.png Captured: 2026-09-11 03:01:46 UTC Source report: https://radar.cloudflare.com/scan/f229a3d6-9ab5-4c6e-8bb2-29fa802b85b0 SHA-256: 8325977a7299b61619ed1ac476c2d261c757275a705b0acbd6b93dd24686c24e - URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a0859d-cccb-716c-8072-c7915be6e11e.png Captured: 2026-09-09 10:01:52 UTC Source report: https://urlscan.io/result/01a0859d-cccb-716c-8072-c7915be6e11e/ SHA-256: c6d4987dc0fc7750fc6f5409b8edee8d2b42f120298928cb999d83d8baa973f9 - URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a0885f-55c4-735a-9b6d-e15be0d597fd.png Captured: 2026-09-09 22:52:37 UTC Source report: https://urlscan.io/result/01a0885f-55c4-735a-9b6d-e15be0d597fd/ SHA-256: 02dd074adac6567889e5a24b06d930938910b21cfb8f1b6878f2bf880526aa53 - URLScan · 2026-09-10: https://screenshots.phishdestroy.io/us/01a08a89-7cb7-772b-9afe-df244bf67348.png Captured: 2026-09-10 08:57:49 UTC Source report: https://urlscan.io/result/01a08a89-7cb7-772b-9afe-df244bf67348/ SHA-256: 7992da78dcf16733c0a5102a7d686c9cd6bd438e9acdd3a273fd2ffbf68168f5 - URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09b5b-1ee9-726b-95ea-475b97f60b69.png Captured: 2026-09-13 15:20:44 UTC Source report: https://urlscan.io/result/01a09b5b-1ee9-726b-95ea-475b97f60b69/ SHA-256: cd557ec4c086697ac151222d791a72bb62ac9cf71073eada6b83f74654229e96 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T00:20:13Z", "uuid": "01a08e69-5fa8-71dd-b393-75c02bf9bd1c", "scanned_at": "2026-09-11T03:01:14Z", "final_url": "https://worldqfslobstrledgerweb.co.uk/home.php", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://worldqfslobstrledgerweb.co.uk/", "from": "http://worldqfslobstrledgerweb.co.uk/", "status": 307 }, { "to": "https://worldqfslobstrledgerweb.co.uk/home.php", "from": "https://worldqfslobstrledgerweb.co.uk/", "status": 302 } ], "ip": "79.133.41.250", "domains": [ "ichef.bbci.co.uk", "unpkg.com", "coin-images.coingecko.com", "img.icons8.com", "widget-v3.smartsuppcdn.com", "www.gstatic.com", "rss.app", "fonts.gstatic.com", "fonts.googleapis.com", "ajax.googleapis.com", "websocket-visitors.smartsupp.com", "translations.smartsuppcdn.com", "bootstrap.smartsuppchat.com", "translate-pa.googleapis.com", "www.smartsuppchat.com", "api.coingecko.com", "translate.googleapis.com", "code.jquery.com", "widget.rss.app", "widgets.coingecko.com", "translate.google.com", "quantumfinancialledger.com", "worldqfslobstrledgerweb.org" ], "ips": [ "184.30.156.176", "195.181.170.18", "18.193.178.22", "172.67.142.173", "172.66.160.245", "172.217.118.4", "142.251.127.94", "37.19.194.81", "104.20.41.132", "142.251.110.95", "142.250.154.94", "151.101.65.155", "104.18.1.22", "142.251.20.95", "104.20.31.127" ], "asns": [ "16625", "60068", "16509", "13335", "15169", "54113", "214036" ], "countries": [ "NL", "DE", "US" ], "link_domains": [ "translate.google.com" ], "doc_hash": "ddfbdc22fd3e0de978d162f6ad1e2a4b3207f5304ef1a208181ada9da145d1d6", "script_hashes": [ "6c23e6774e32d8ddae5967d9b6994c1b20942cd7877b6cc330afdf1d485cae9f", "76ad2b84e2d7229bfc6273f01970dd4c73378cc1737b317a336ae3e1a97517a5", "94e94bdf24c20f5c2e793914d49fc5595abfbf5d9219fed41eb164f15d006946", "507126cb87dc9d567fe2a2f6e4347da227b3fc671f22620e548e20afbacb67c1", "d80e19f491765da73a7204b2749e12d2818da10a602d9eadf62333307fa2874d", "6089424547c1b9b65e62e908d61e7f1d88b1e61bd7c7ebb0ad1564666d8b4d3a" ], "globals": [ "ISM", "Dragdealer", "googleTranslateElementInit", "_DumpException", "google", "__core-js_shared__", "core", "regeneratorRuntime", "$", "jQuery", "uidEvent", "bootstrap", "Splide", "pageBody", "appSidebar", "loader", "goBackAnimation", "goBackButton", "tooltipTriggerList", "tooltipList", "aWithHref", "clearInput", "formControl", "searchboxToggle", "uploadComponent", "notificationCloseButton", "notificationTaptoClose", "notificationBox", "closeNotificationBox", "notification", "toastCloseButton", "toastTaptoClose", "toastBoxes", "closeToastBox", "toastbox", "osDetection", "windowsPhoneDetection", "androidDetection", "iosDetection", "iosAddtoHome" ], "cookies": [ "XSRF-TOKEN", "laravel_session" ], "storage_keys": [ "FinappAddtoHome", "gecko-cache:https://api.coingecko.com/api/v3/coins/markets" ], "tls": { "san": [ "cpanel.trumpsecureledger.org", "cpanel.worldqfslobstrledgerweb.co.uk", "cpcalendars.trumpsecureledger.org", "cpcalendars.worldqfslobstrledgerweb.co.uk", "cpcontacts.trumpsecureledger.org", "cpcontacts.worldqfslobstrledgerweb.co.uk", "fultontrustbank.org.worldqfslobstrledgerweb.co.uk", "mail.trumpsecureledger.org", "mail.worldqfslobstrledgerweb.co.uk", "qauntumgloballedgerbackup.org.worldqfslobstrledgerweb.co.uk" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "webdisk.trumpsecureledger.org", "protocol": "TLS 1.3", "valid_to": "2026-12-07T14:42:24Z", "valid_from": "2026-09-08T14:42:25Z" }, "domain_age_days": 2, "apex_age_days": 2, "tls_age_days": 2, "tls_valid_days": 89, "requests": 161, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T02:32:39Z", "uuid": "f229a3d6-9ab5-4c6e-8bb2-29fa802b85b0", "scanned_at": "2026-09-11T03:01:46Z", "final_url": "https://worldqfslobstrledgerweb.co.uk/home.php", "status": 200, "redirected": "same-domain", "history": [ { "url": "https://worldqfslobstrledgerweb.co.uk/", "status": 302 }, { "url": "https://worldqfslobstrledgerweb.co.uk/home.php", "status": 200 } ], "dom_hash": "0ae4faf5f34749d212526704151745fe561c21fca624d879fa9410fe24e32bc7", "doc_hash": "ddfbdc22fd3e0de978d162f6ad1e2a4b3207f5304ef1a208181ada9da145d1d6", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "worldqfslobstrledgerweb.co.uk", "type": "A", "value": "79.133.41.250" } ], "dnssec_valid": false, "ip": "79.133.41.250", "whois": { "registrar": "Dynadot, LLC t/a Dynadot [Tag = DYNADOT]", "created": "2026-09-08T00:00:00Z", "updated": "2026-09-08T00:00:00Z", "expires": "2027-09-08T00:00:00Z", "nameservers": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T16:23:13Z", "analysis_at": "2026-09-25T11:10:12Z", "stats": { "timeout": 0, "harmless": 49, "malicious": 7, "suspicious": 1, "undetected": 35 }, "detections": { "CRDF": "malicious", "G-Data": "malware", "Sophos": "malware", "Fortinet": "spam", "SOCRadar": "phishing", "BitDefender": "malware", "alphaMountain.ai": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Spam (alphaMountain.ai)" }, "first_seen": "2026-09-08T12:24:39Z", "dns": [ { "ttl": 14400, "type": "MX", "value": "worldqfslobstrledgerweb.co.uk", "priority": 0 }, { "ttl": 21600, "type": "SOA", "rname": "hosting-notify.ultahost.com", "value": "ns1.ultahost.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.ultahost.com" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 ip4:79.133.41.250 +a +mx include:relay.mailchannels.net ~all" }, { "ttl": 21600, "type": "NS", "value": "ns1.ultahost.com" }, { "ttl": 21600, "type": "NS", "value": "ns4.ultahost.com" }, { "ttl": 21600, "type": "NS", "value": "ns3.ultahost.com" }, { "ttl": 11544, "type": "A", "value": "79.133.41.250" } ], "dns_at": "2026-09-10T12:11:31Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "cpanel.trumpsecureledger.org", "cpanel.worldqfslobstrledgerweb.co.uk", "cpcalendars.trumpsecureledger.org", "cpcalendars.worldqfslobstrledgerweb.co.uk", "cpcontacts.trumpsecureledger.org", "cpcontacts.worldqfslobstrledgerweb.co.uk", "fultontrustbank.org.worldqfslobstrledgerweb.co.uk", "mail.trumpsecureledger.org", "mail.worldqfslobstrledgerweb.co.uk", "qauntumgloballedgerbackup.org.worldqfslobstrledgerweb.co.uk" ], "issuer": "Let's Encrypt / YR1", "serial": "5adc8ef599e42af99a7acaaf7469f8483fe", "sha256": "7d049c526170272119bb4311754da23eefa9157d97db9a34139e95963ff4b9d1", "subject": "webdisk.trumpsecureledger.org", "valid_to": "2026-12-07T14:42:24Z", "valid_from": "2026-09-08T14:42:25Z" } } } ```