qfs-ledger[.]us

The domain qfs-ledger.us is a high-risk phishing site engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. It presented itself as a legitimate crypto wallet login portal under the title 'QFS LEDGER | Crypto Wallet Account Login' but was designed to harvest user credentials through credential phishing. No drainer kit was identified in this campaign. The site is currently taken offline, though prior activity posed a significant threat to users seeking Ledger services.

Technical indicators confirm the malicious nature of qfs-ledger.us. The domain was flagged by 14 of 95 security vendors on VirusTotal, including ADMINUSLabs, alphaMountain.ai, and BitDefender, while appearing on 4 security blocklists such as PhishDestroy, Polkadot, and Enkrypt. Registered through ENOM, INC. on March 05, 2025, it resolved to the IP address 194.36.191.196, hosted by Host Sailor Ltd (AS60117) in the Netherlands. The SSL certificate was issued by Let's Encrypt / R12, and the site employed technologies like LiteSpeed, jQuery, and JivoChat. Gridinsoft assigned it a trust score of 0/100, and Google Safe Browsing did not flag it at the time of analysis.

Users who interacted with qfs-ledger.us should immediately change any exposed passwords, particularly for Ledger or cryptocurrency accounts, and enable two-factor authentication. Monitor financial and crypto wallets for unauthorized transactions, and consider revoking any token approvals if wallet connections were made. Report the domain to Ledger’s official security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.