qfsledgertrust[.]com

The domain qfsledgertrust.com was observed on 12 July 2026 as an active high‑risk site that impersonates the Ledger brand. The page title returned by the server is “Ledger”, matching the declared brand target. VirusTotal records indicate that three out of ninety‑five scanning engines have flagged the domain as malicious, confirming a low but notable detection rate. Technical resolution shows the domain resolves to IP address 198.251.84.7, which belongs to AS53667 operated by FranTech Solutions in the United States. The domain was registered on 16 September 2025 through Cosmotown, Inc., and uses a Let’s Encrypt certificate (issuer E7) that currently presents a valid HTTPS handshake. HTTP requests return status code 200, indicating the site is serving content. The hosting environment reports WordPress, MySQL, PHP, LiteSpeed, jQuery, Yoast SEO, Smartsupp, and embedded YouTube assets, suggesting a standard CMS deployment rather than a custom phishing kit. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. The identified scam type is cryptocurrency, aligning with the Ledger brand’s association with hardware wallets. Defenders should add the IP 198.251.84.7 and the domain qfsledgertrust.com to outbound and inbound filtering rules, monitor DNS queries for the associated nameservers ns1.host2uls.com and ns2.host2uls.com, and enforce TLS inspection to capture any credential or payment data that might be exfiltrated. Continuous re‑evaluation is advised, as additional detections could increase the vendor flag count and trigger broader blocklisting.