qfsnanoxleger[.]co

The domain qfsnanoxleger.co is a confirmed phishing site engaged in brand impersonation targeting Bitfinex users. It presents a fraudulent login page designed to harvest credentials, classified as an elevated-risk scam. No crypto drainer kit was identified. The site is currently taken offline, though prior activity remains a threat to victims who may have entered sensitive information.

Technical indicators confirm qfsnanoxleger.co was flagged by 2 of 95 VirusTotal security vendors, including Gridinsoft and Netcraft, with a Gridinsoft trust score of 0/100. It appears on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. Registered through Cosmotown, Inc. on January 24, 2025, the domain resolved to IP address 208.98.35.111 (US, AS46844 Sharktech) and used nameservers ns1.site4now.net, ns2.site4now.net, and ns3.site4now.net. No SSL certificate was present, and the observed page title was 'Homep- Home'. The HTTP status returned 429 at the time of analysis.

Victims of qfsnanoxleger.co should immediately change any passwords entered on the site, particularly for Bitfinex or linked accounts, and enable two-factor authentication (2FA) where available. Monitor financial accounts for unauthorized transactions and report suspected fraud to the impersonated brand’s official support channels. The domain can be reported to PhishDestroy, Google Safe Browsing, and local cybercrime authorities for further action.