qfxworld[.]com

PhishDestroy flags qfxworld.com as a suspicious domain engaged in brand impersonation phishing, designed to deceive users into connecting cryptocurrency wallets to a malicious drainer kit. The site masquerades as a legitimate brand, likely targeting crypto investors with offers that appear too good to be true. While no specific drainer kit signature has been publicly documented for this domain, the observed behavior aligns with common crypto drainer campaigns that exfiltrate wallet credentials and drain funds in near real-time.

This domain resolves to IP address 145.79.211.176 and is registered through HOSTINGER operations, UAB. The domain was created on January 29, 2026, and currently holds a legitimate SSL certificate issued by Let's Encrypt, which may be used to enhance credibility and bypass browser-based security warnings. As of the latest scan, VirusTotal reports 1 out of 95 security vendors flagging the domain as malicious, indicating it is not yet widely recognized by threat intelligence systems. The domain has not yet been evaluated by Google Safe Browsing (GSB) and is not included in major blocklists at this time, suggesting it is operating in a gray window of opportunity for threat actors.

At present, qfxworld.com remains active and unblocked by most security platforms, posing an active risk to users who may interact with it under false pretenses. Due to its recent creation and low detection rate, the domain presents a high-risk window for exploitation. Users are strongly advised to avoid interacting with the site and to report any encounters to their security provider or relevant authorities. Immediate blocklisting through network defenses and browser-based security policies is recommended to mitigate exposure. The risk level remains under investigation but is currently classified as active, warranting heightened vigilance from both users and cybersecurity teams.