qfxvault[.]com

This domain is flagged for elevated-risk credential theft targeting financial service users. Analysis indicates qfxvault.com operated as a fraudulent portal designed to harvest login credentials, likely impersonating legitimate banking or payment platforms. The threat type is specifically credential theft, not generic phishing, with a focus on capturing sensitive financial account details for unauthorized access or fraudulent transactions. Infrastructure analysis reveals the domain was registered on September 25, 2025, through TUCOWS.COM, CO. and resolved to IP address 104.21.84.124. It appears on one security blocklist and is currently blocked by PhishDestroy. The domain received a trust score of 0/100 from Gridinsoft, while VirusTotal reports 4 out of 95 security vendors flagging it as malicious. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, with an SSL certificate issued by Google Trust Services. The page title 'One moment, please...' suggests the use of Cloudflare interstitial pages, a common tactic to evade detection or delay analysis. Mitigation steps for credential theft threats include immediate password resets for any accounts accessed via this domain, particularly financial services. Organizations should deploy DNS-based blocking for the domain and its resolved IP (104.21.84.124) across all network layers. End-users are advised to enable multi-factor authentication (MFA) on all financial accounts and verify domain authenticity before entering credentials. Security teams should monitor for indicators of compromise (IoCs) such as the domain, IP, and SSL certificate fingerprint in logs, and conduct retrospective analysis for any prior interactions with the infrastructure.