qfxbackup[.]com

Analysis of the domain qfxbackup.com, created on February 21, 2026 and hosted on the AS329278 Truehost Cloud Limited network in the United States, shows multiple indicators of malicious activity. The site resolves to IP address 102.212.246.67 and serves content over HTTPS using a Let’s Encrypt R13 certificate, returning an HTTP 200 status code. The page title observed is "QFX Backup – QFX," suggesting the site is attempting to masquerade as a backup service for the QFX brand, although the content has not been publicly dissected. VirusTotal records indicate that one of ninety‑three security vendors has flagged the domain, and the domain appears on four external blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura.

Additional reputation data shows a Gridinsoft trust score of 0 out of 100, reinforcing the high‑risk assessment. The domain’s MX record is configured with priority 0 pointing to qfxbackup.com, which could be used for phishing email delivery. Technical fingerprinting reveals the presence of jQuery, jQuery Migrate, and HTTP/3 support, while the authoritative nameservers are ns1.cloudoon.com, ns2.cloudoon.com, ns2.cloudoon.net, ns3.cloudoon.com, and ns3.cloudoon, all associated with the cloudoon hosting provider. Registration was performed through OwnRegistrar, Inc., a registrar that does not provide additional protective metadata.

While the exact phishing payload and targeted user interaction remain unverified, the convergence of low trust scores, vendor flagging, blocklist inclusion, and the deceptive page title warrants a high‑risk classification. Defenders should block the domain at network perimeters, add the associated IP and nameservers to deny‑list rules, monitor for outbound SMTP traffic to the listed MX host, and flag any email or web traffic referencing the QFX backup theme for further investigation. Continuous re‑evaluation is advised as additional intelligence becomes available.