worldqfslobstrledger[.]org

This domain, worldqfslobstrledger.org, presents an elevated-risk brand impersonation threat targeting Ledger cryptocurrency wallet users. Analysis indicates the site mimics legitimate Ledger interfaces, likely deploying counterfeit wallet connection prompts or recovery phrases submission forms to harvest private keys or seed phrases. Such infrastructure is commonly associated with crypto drainer operations, where victims unknowingly authorize malicious transactions that empty their wallets. The page title 'Worldqfslobstrledger - Home' further suggests an attempt to deceive users into believing they are interacting with an official Ledger service or affiliated platform. Evidence supporting the malicious classification includes detection by 2 out of 95 security vendors on VirusTotal, presence on one security blocklist, and registration through Atak Domain Bilgi Teknolojileri A.Ş. on August 07, 2025. The domain resolves to the IP address 79.133.41.250, which may host additional fraudulent infrastructure. Gridinsoft assigns a trust score of 0/100, reinforcing the domain’s high-risk status. The rapid deployment and low detection rate suggest an attempt to evade automated security systems during the initial attack window. Users who visited worldqfslobstrledger.org or interacted with its content should immediately revoke any wallet connections made through the site. Disconnect all dApps and review recent transaction history for unauthorized activity. If seed phrases or private keys were entered, transfer remaining assets to a new, secure wallet and consider the original wallet compromised. Monitor accounts for signs of follow-up phishing attempts, as threat actors may reuse collected data for further attacks. Report the domain to relevant abuse channels to assist in takedown efforts and prevent additional victims.