eth-qr[.]to

Analysis of the domain eth-qr.to indicates a high-risk crypto scam impersonating Ethereum, specifically targeting users through a fraudulent QR code generator service. The domain, registered on January 8, 2024, via the Government of the Kingdom of Tonga, resolves to IP address 45.12.2.86, hosted by Virtual Systems LLC (AS6698) in Ukraine. Infrastructure analysis reveals the use of nameservers ns1.zomro.net and ns2.zomro.ru, and the absence of an SSL certificate, increasing exposure to interception risks. The page title, 'Ethereum QR Code Generator,' directly aligns with the reported scam type, suggesting an attempt to deceive users into interacting with malicious QR codes for wallet or credential theft.

Detection metrics confirm the domain's malicious classification: 13 of 95 security vendors on VirusTotal flagged eth-qr.to as malicious, and it appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Trust scores from Gridinsoft (0/100) and Scamadviser (1/100) further corroborate its fraudulent nature. AlienVault OTX lists the domain in 16 threat intelligence pulses, indicating active tracking by security researchers. As of July 23, 2026, the domain is offline, though its infrastructure remains registered.

Defenders should treat eth-qr.to as a confirmed phishing domain and maintain blocklist entries to prevent user exposure. No evidence of a phishing kit or additional page content is available for analysis, limiting further classification of attack vectors. Organizations are advised to monitor for related domains using similar naming conventions or infrastructure, particularly those leveraging QR code themes to impersonate Ethereum or other cryptocurrency services.