1776qfs[.]net

The domain 1776qfs.net is currently active and serves a page titled “QFS GESARA – Your Financial Freedom Begins here”. The site returns HTTP 200 and resolves to IP 163.61.188.9, which is geolocated to the United States (MIT). The domain was registered on May 16 2026 through Internet Domain Service BS Corp and uses LetsEncrypt (R12) TLS certificates. Its authoritative name servers are dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting.com. Infrastructure analysis shows the host appears on one security blocklist and has been cited in a single AlienVault OTX pulse. VirusTotal scans report four of ninety‑two vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of 1 / 100. The site is already blocked by PhishDestroy. While the page title and the listed “Investment Scam” classification indicate a financially‑oriented phishing campaign, no additional malware payloads, credential‑stealing forms, or redirect behaviors have been observed. Defenders should continue to block 1776qfs.net at perimeter filters, monitor outbound connections to 163.61.188.9, and update threat intelligence feeds with the observed indicators. Further analysis of the landing page content is recommended to confirm any credential‑harvesting mechanisms and to assess whether the site is being used in a broader campaign targeting specific financial entities.