mail[.]world-quantumleap[.]com

Analysis of mail.world-quantumleap.com shows a freshly registered domain created on February 21, 2026 and hosted on a Hetzner infrastructure in Finland (AS24940). The domain resolves to IP address 135.181.226.231 and is served over HTTPS with a Let’s Encrypt R12 certificate. HTTP requests receive a 301 redirect, and the sole page title returned is “QUANTUM FINANCIAL SYSTEM”. Nameservers dm1.ourdns.site and dm2.ourdns.site are listed, both pointing to the same hosting provider. The site leverages Smartsupp and HTTP/3, indicating the use of modern web technologies.

Threat intelligence flags the domain as high‑risk generic phishing. It is blocked by PhishDestroy and appears on one security blocklist. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records a single positive detection out of 95 scanned vendors. The combination of a low trust score, blocklist presence, and the “QUANTUM FINANCIAL SYSTEM” title aligns with typical credential‑ harvesting operations targeting financial services. The risk level is marked as high and the status remains active.

While the infrastructure and external indicators strongly suggest malicious intent, the actual content of the site beyond the page title has not been publicly disclosed, leaving the exact phishing workflow uncertain. Defenders should prioritize immediate containment by adding the domain and its associated IP to outbound filtering rules and DNS blocklists. Continuous monitoring of the IP range and associated nameservers is advised, as well as sinkholing traffic to gather further evidence. Organizations receiving phishing reports referencing “Quantum Financial System” should treat any communications from this domain as hostile and educate users to avoid interaction.