Is qweb3ledger.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

QFS Web3 Ledger is a cryptocurrency-themed website presented under the title "QFS WEB3 LEDGER – Your Financial Freedom Begins here". Its homepage uses ledger and financial-system branding and an aspirational "financial freedom" message to position itself as a gateway to web3 financial services. Its apparent purpose is to draw visitors into an account or sign-in flow, since the homepage contains a password entry form. The page content captured for this assessment did not allow the specific products, yields or features on offer to be itemised.

Scam/Impersonation Risk

This site shows confirmed contradictory signals. A multi-engine reputation check lists the domain as malicious, including detections from three tier-one security vendors, and the domain is treated as blacklisted by external threat sources. The detections are not tied to a specific category, so the evidence does not establish whether the cause is phishing, malware or another abuse type. No impersonation of a named third-party brand was identified, and no conflicting legal identities appear. The blacklist status alone is a serious, independent risk indicator. The domain is also under a year old, has a very thin archive footprint, and was registered through a web3-oriented registrar. These facts give the site no accumulated reputation to offset the external detections. In behavioural testing, the homepage made a high volume of calls to third-party endpoints, including several to destinations outside the commonly trusted set. It also rewrote large parts of its page structure after interaction and produced many script errors, which points to a heavily scripted page. The tests detected no wallet-connection prompts, wallet-drainer behaviour, clipboard tampering, hidden forms or content cloaking. These non-detections do not outweigh the external listings. Evidence:

• Homepage: external threat sources flag the domain as malicious, with detections from three tier-one security vendors, and it is treated as blacklisted.
• Homepage behaviour: the page made 18 external XHR requests and 9 external POSTs, 6 of them to non-whitelisted destinations, and logged 37 console errors. DOM mutations reached 3,204 after interaction.
• Homepage form: one password-entry form was present, which makes the external-traffic pattern relevant to credential safety.
• Domain provenance: registered 2025-10-31 (~1 year old), with 3 archive snapshots, all in 2026 (1 year tracked).

Regulatory Verification Notes

The site presents no regulatory authorisation, licence reference or registry linkage in the captured content. No third-party broker or regulatory reputation record was matched to this domain. Disclosure of the operating entity is unclear, and the registration data leaves ownership opaque. That opacity is an administrative limitation, not an identity contradiction. It matters here because the site invites credential entry while offering no accountable operator to hold responsible, and it compounds the reputational concerns above. The site's own financial-freedom positioning is an unsubstantiated promotional claim, not a disclosed regulated activity. Evidence:

• Homepage: the captured content shows no licence number, regulator reference or named legal entity.
• Registration record: registrar is Unstoppable Domains Inc., expiring 2026-10-31, with owner details incomplete.
• Transport and hosting: TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-19; served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Any dealings with this site should begin with independent confirmation of who operates it and whether any regulator recognises it as a licensed provider. Licensing should be checked directly in the relevant national financial-regulator registers, not through links or claims on the site. The official support and contact channels should be confirmed through an independent, offline route. It should also be established whether the cause of the external detections has been investigated and resolved. Re-checking the domain's status with the threat-intelligence sources would show whether the listings have been cleared. Evidence:

• Homepage: no regulator or licence reference is available to check against a registry.
• Reputation record: the external malicious listings are current and remain unresolved.
• Domain history: the registration is about a year old and the archive coverage is minimal, so there is no earlier history to confirm legitimacy.

Summary Verdict

The overall posture is high-risk. Current external threat detections and a young, thinly documented domain outweigh the site's technically valid encryption and mainstream hosting. The available evidence does not support treating the site as a legitimate or safe destination for sensitive interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge servers, so the origin server was not observable. The certificate is valid and issued by a known authority. These are mitigating technical factors only. They show competent delivery infrastructure, but they say nothing about the operator's intent, and they do not offset the external reputation findings. Edge-only visibility also prevents independent hosting verification and can mask rapid content changes. Unconfirmed heuristics flag some infrastructure fragmentation, which carries little weight alongside the confirmed findings.

Closing Assessment

Credentials, wallet connections, personal data and funds should not be submitted to this site. At most, it should be viewed passively from an isolated environment. Anyone who has already entered a password or approved a transaction should change the affected credentials, review wallet permissions, and report the domain to the relevant security or fraud channel.