quantumfinanceledgerx[.]com

PhishDestroy identifies quantumfinanceledgerx.com as an active crypto drainer campaign designed to trick users into connecting cryptocurrency wallets and siphon assets. The domain mimics legitimate financial ledger services, presenting a fraudulent login portal that requests wallet connections under the guise of identity verification or transaction approval. Once a victim authorizes the connection via a wallet provider such as MetaMask or Phantom, the drainer automatically transfers supported tokens (e.g., ETH, USDT, SOL) to attacker-controlled wallets using malicious smart contract interactions. Security researchers have observed this technique leveraging fake “balance checks” and “transaction previews” to deceive users into granting unlimited spending approvals. This domain was flagged by PhishDestroy on October 18, 2024, the same day it was registered through TuringSign Inc. d/b/a Cosmotown. It resolves to IP address 163.61.188.7 and is protected by a Let’s Encrypt SSL certificate, which increases its appearance of legitimacy. VirusTotal currently shows only 1 out of 95 security vendors detecting the threat, highlighting how new and evasive this campaign remains. The use of a freshly registered domain and low detection rate suggests this criminal operation is actively evolving to bypass automated defenses. Users who visited quantumfinanceledgerx.com should immediately disconnect any connected wallets using their wallet’s interface to revoke permissions. Scan wallets with tools like Etherscan’s Token Approval Checker or DeBank to identify unauthorized approvals and revoke them immediately. If any tokens were stolen, file a police report and report the incident to your local cybercrime unit. Do not interact with this domain further—block it in your browser and DNS settings, and warn others in your network to avoid it entirely.