qfs-web3-ledger[.]com

This domain, qfs-web3-ledger.com, is actively engaged in brand impersonation targeting Ledger, a hardware wallet provider. The threat type is classified as high-risk brand impersonation, designed to deceive users into interacting with fraudulent infrastructure under the guise of legitimate wallet services. As of the latest analysis, the domain remains operational and unresolved by the registrant. Infrastructure analysis reveals the domain resolves to the IP address 51.89.0.70, hosted on autonomous system AS16276 (OVH SAS) in Germany. It is registered through TuringSign Inc. d/b/a Cosmotown, with a creation date of May 17, 2024. Detection metrics indicate the domain is flagged by 11 of 95 security vendors on VirusTotal, while three independent security blocklists have listed it as malicious. The SSL certificate is issued by Let’s Encrypt (R12), a common tactic to lend superficial legitimacy to phishing infrastructure. Additional indicators include active blocking by multiple threat intelligence feeds, further corroborating its malicious intent. Current status confirms the domain remains active and accessible. Organizations and end-users are advised to implement immediate network-level blocking of the domain and its associated IP address. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range, as these may represent additional vectors in the same campaign. Users should verify all communications and web interfaces against official Ledger channels, particularly those involving wallet management or recovery processes.