qfsweb3backup[.]com

Analysis of qfsweb3backup.com shows a credential phishing infrastructure targeting Facebook users. The domain was created on November 08, 2025 and is currently taken offline, but historical DNS resolution points to IP address 159.195.9.211, which belongs to AS197540 netcup GmbH in Germany. No SSL certificate was observed, indicating the site operated without HTTPS protection. The page title returned by the server is "Qfsweb3backup," providing no additional context about the phishing payload.

Registration was performed through HOSTINGER operations, UAB, and the domain uses four nameservers: ks1.kingspeed.com, ks2.kingsspeed.com, ns1.nextbytedns.com, and ns2.nextbytedns.com. The site appears on a single blocklist—PhishDestroy—and has been flagged by 2 of 95 security vendors on VirusTotal, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of credibility.

The combination of a brand impersonation label, the credential phishing classification, and the low trust score confirms the domain as a malicious actor attempting to harvest Facebook credentials. Defenders should add the domain and its associated IP address to deny lists, ensure outbound traffic to the IP is blocked, and monitor for future registrations using the same registrar, nameserver patterns, or IP range. Continuous threat‑intel feeds should be consulted for any re‑use of the infrastructure, and any internal alerts referencing Facebook credential collection should be correlated with this indicator to improve detection coverage.