qfs-worldvault[.]org

qfs-worldvault.org is an active phishing domain that currently evades detection by serving benign content to scanners, as indicated by its low cloaking score of 2/10. Despite these evasive tactics, 13 out of 91 VirusTotal vendors have flagged this domain as malicious, underscoring its threat potential. The domain is registered with Atak Domain Bilgi Teknolojileri A._. and is hosted on IP address 5.182.208.206 in the Netherlands under AS62068 SpectraIP B.V.

PhishDestroy has placed qfs-worldvault.org on its public blocklist, highlighting the domain's involvement in malicious activities. The domain's SSL certificate is issued by Let's Encrypt, which is often used by threat actors to lend legitimacy to phishing sites. The domain was created on May 21, 2026, and PhishDestroy identified it as a threat by June 22, 2026.

The domain's ability to present benign content to scanners makes it particularly challenging for traditional detection methods. This tactic allows the domain to exploit the gap between registration and antivirus database updates, making early detection crucial to mitigate its impact. By leveraging these techniques, qfs-worldvault.org poses a significant risk to unsuspecting users who may be lured into divulging sensitive information.