qfsallbackup[.]com

Analysis of the domain qfsallbackup.com, observed on July 24, 2026, indicates that it is associated with a generic phishing campaign and is currently offline. The domain was registered on May 12, 2025 through Cosmotown, Inc. and is delegated to the authoritative name servers ns1.site4now.net, ns2.site4now.net and ns3.site4now.net. DNS resolution points to the IPv4 address 208.98.35.172, which belongs to AS46844 Sharktech and is geolocated in the United States. The web server presents a TLS certificate issued by Let’s Encrypt (R13) and the HTTP response header reveals a stack comprising PHP, Microsoft ASP.NET, Bootstrap and Internet Information Services (IIS) on a Windows Server platform.

The page title returned by the server is “qfsassets-backup”. The domain has been listed on four external blocklists and is actively blocked by the phishing mitigation services PhishDestroy, Polkadot, Enkrypt and Codeesura. VirusTotal analysis shows that one out of ninety‑five scanned security vendors flagged the domain, confirming the presence of malicious activity. No additional intelligence such as payload samples, credential harvesting URLs, or victim reports is publicly available, so the exact phishing vector and targeted brand remain undefined.

Defenders should continue to deny network connections to 208.98.35.172, enforce DNS filtering for qfsallbackup.com, and monitor the associated name servers for any re‑activation. Updating intrusion‑prevention signatures with the observed SSL fingerprint and server fingerprint can reduce false negatives. Because the site is already taken offline, threat actors may attempt to relocate the campaign to a new domain; continuous threat‑intel feeds and blocklist updates are recommended to detect any successor infrastructure promptly.