minepayqfs[.]com

The domain minepayqfs.com was registered on October 28, 2025 through NameCheap, Inc. and is currently listed as offline after being taken down. The site hosted a page titled "Phantom QFS Wallet" and was classified as a Wallet/Seed Phishing operation that impersonates the Binance brand. Technical indicators show the domain resolves to IP address 2.57.89.32, which belongs to AS47583 Hostinger International Limited and is geolocated in the Netherlands. Nameserver records point to ns1.dns-parking.com and ns2.dns-parking.com, typical of parked or abandoned domains.

No SSL certificate was observed for the host, indicating the site was served over plain HTTP. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious nature of the infrastructure. The domain appears on at least one security blocklist and was actively blocked by PhishDestroy, confirming its detection by external mitigation services. VirusTotal analysis recorded 14 detections out of 95 scanning engines, providing additional corroboration of its phishing intent.

Given the combination of registrar data, hosting location, lack of TLS, low trust score, and multiple vendor detections, the infrastructure can be regarded as high‑confidence malicious. Defenders should ensure the domain is added to deny‑list filters, monitor DNS resolution for any re‑hosting attempts, and block traffic to the associated IP range. Continuous observation of the registrar’s activity and the nameservers is advised to detect potential re‑use or resurrection of the domain for future campaigns.