quantumlibertyfin[.]com

Analysis of quantumlibertyfin.com indicates that the domain is being used for a wallet/seed phishing campaign targeting the Chase brand. The site was registered on August 30, 2025 through NameCheap, Inc., and the registration details point to NameCheap’s hosting infrastructure (ASN 22612, United States). DNS resolution directs traffic to the IPv4 address 69.57.162.167, which is hosted on the same NameCheap network and lacks an SSL/TLS certificate, exposing all HTTP traffic to interception. The domain’s authoritative name servers are dns1.namecheaphosting.com and dns2.namecheaphosting.com, both typical of NameCheap‑hosted domains.

Gridinsoft assigns a trust score of 1 out of 100, reflecting an extremely low reputation. The page title presented by the site, “Earn and Borrow Crypto | Quantum Financial System,” aligns with the wallet/seed phishing narrative and does not reference the impersonated brand directly, but the intelligence explicitly states that the campaign impersonates Chase. Detection footprints include listings on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple anti‑phishing services have flagged the domain. VirusTotal scans report three positive detections out of ninety‑three security vendors, corroborating the malicious classification.

The site is currently offline, but historical evidence suggests it was actively serving phishing content before takedown. Defenders should block the domain and its associated IP at perimeter defenses, monitor for any residual use of the observed name servers, and update detection rules to include the specific page title and the observed lack of TLS. Continuous observation of NameCheap‑associated infrastructure is advised, as the registrar’s low‑cost services are frequently leveraged for similar campaigns.