# PhishDestroy domain threat record: usd-qr-code.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/usd-qr-code.com/ Machine-readable companion: https://phishdestroy.io/domain/usd-qr-code.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-16 01:43:23 UTC - Last availability or vendor check: 2026-10-22 10:42:33 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 6/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: across ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: SOLLUTIUM LLC - Registrar country in stored WHOIS data: REDACTED FOR PRIVACY - Last stored HTTP status: 200 - Registration date (registry RDAP, usd-qr-code.com): 2025-12-11 06:13:11 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1425f-4877-7035-a79c-def0dbfdc07b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/usd-qr-code.com - Certificate Transparency search: https://crt.sh/?q=%25.usd-qr-code.com - Web Archive lookup: https://web.archive.org/web/*/https://usd-qr-code.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview usd-qr-code.com is an impersonation phishing page dressed up as a free tool for making USDC wallet QR codes. It targets people who hold, send or receive the USDC stablecoin and want a quick way to share a payment address. PhishDestroy first saw the site on 2026-10-16. As of 2026-10-19 it was still online and serving live content. How the scam works The page presents itself as "USDC QR Code Generator — Instant Wallet QR Maker Free". It invites visitors to paste an address or connect a wallet to produce a scannable code. Fake generators of this kind commonly swap in an address the operator controls, so anyone who scans the shared code sends funds to the scammer instead of the intended recipient. Others push visitors to connect a wallet or enter a recovery phrase, which can lead to the wallet being emptied. Stablecoin transfers are irreversible, so funds sent to the wrong address are usually gone for good. Evidence Detection by outside vendors is still thin. On 2026-10-16, VirusTotal showed 1 of 92 engines flagging the domain, and that engine was Webroot. The domain appears on the PhishDestroy blocklist and is referenced in 4 AlienVault OTX pulses. Low vendor coverage is typical of newly reported phishing sites and does not mean the page is safe. Infrastructure The domain was registered on 2025-12-11 through SOLLUTIUM LLC. It resolves to 188.114.97.3 on the Cloudflare network (CLOUDFLARENET, US), which masks the origin server. Its TLS certificate was issued by Google Trust Services (WE1), so the padlock in the browser says nothing about the site's legitimacy. What to do Do not use QR codes created on this site, and check any USDC address you received from someone who may have used it. If you entered a recovery phrase, treat that wallet as compromised and move your remaining funds to a new wallet with a fresh phrase immediately. If you connected a wallet, review and revoke any token approvals you granted while on the page. Make QR codes only inside your own wallet app, and confirm the full address before you send anything. Defenders should block the domain at DNS, proxy and email gateways, add it to internal threat feeds, and report it to Cloudflare and the registrar so it can be taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1425f-4877-7035-a79c-def0dbfdc07b/ VirusTotal report: https://www.virustotal.com/gui/domain/usd-qr-code.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=usd-qr-code.com Archived copy: https://web.archive.org/web/20261016014530/https://usd-qr-code.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:22:25 UTC ## Stored page captures - Primary capture: https://i.ibb.co/ZzJgwVnj/220bce44239a.png Captured: 2026-10-16 01:43:23 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1425f-4877-7035-a79c-def0dbfdc07b.png Captured: 2026-10-16 01:43:23 UTC Source report: https://urlscan.io/result/01a1425f-4877-7035-a79c-def0dbfdc07b/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d0b93b0e-8f35-4cca-9dba-8538f6fe3c5a.png Captured: 2026-10-16 02:25:29 UTC Source report: https://radar.cloudflare.com/scan/d0b93b0e-8f35-4cca-9dba-8538f6fe3c5a SHA-256: 2c0c50c216b8c803b16fce9743fd98d024341f5b8792aaba890a1b802500717c - URLQuery: https://screenshots.phishdestroy.io/uq/236b9029-470f-47da-b21b-61a11e058c8f.png Source report: https://urlquery.net/report/236b9029-470f-47da-b21b-61a11e058c8f SHA-256: 2060d0fa93477d0382ca43fb66a2b6682d4160cd7d48a70d5a540051e4185b91 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T18:32:19Z", "uuid": "01a1425f-4877-7035-a79c-def0dbfdc07b", "scanned_at": "2026-10-16T01:41:48Z", "final_url": "https://usd-qr-code.com/", "status": 200, "ip": "188.114.97.3", "domains": [ "fonts.gstatic.com", "cdnjs.cloudflare.com", "fonts.googleapis.com" ], "ips": [ "192.178.183.94", "104.17.24.14", "142.251.14.95", "188.114.97.3" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "317e97bbaead7f80a2e3ddc7b3e62666aa3ff5a875ee07da7c69763bd81ffdee", "script_hashes": [ "6904e0af245ead57ed6309a3314b53dd934e5cfac02566e6b4213334b9d74235" ], "globals": [ "ClipboardJS" ], "tls": { "san": [ "usd-qr-code.com", "*.usd-qr-code.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "usd-qr-code.com", "protocol": "QUIC", "valid_to": "2027-01-01T18:59:00Z", "valid_from": "2026-10-03T18:01:13Z" }, "domain_age_days": 308, "apex_age_days": 308, "tls_age_days": 12, "tls_valid_days": 90, "requests": 8, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:59:23Z", "uuid": "d0b93b0e-8f35-4cca-9dba-8538f6fe3c5a", "scanned_at": "2026-10-16T02:25:29Z", "final_url": "https://usd-qr-code.com/", "status": 200, "history": [ { "url": "https://usd-qr-code.com/", "status": 200 } ], "dom_hash": "cdfbd6bd8ee881fb99ff05cc514df99b8d94b0071dea5ae8613d1cf016c8726f", "doc_hash": "08db66cf80931852822e9b0e4ffcc9421793cb924f70d7c1f9d20bb7a96348f7", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "usd-qr-code.com", "type": "A", "value": "172.67.173.102" }, { "name": "usd-qr-code.com", "type": "A", "value": "104.21.72.8" }, { "name": "usd-qr-code.com", "type": "AAAA", "value": "2606:4700:3034::ac43:ad66" }, { "name": "usd-qr-code.com", "type": "AAAA", "value": "2606:4700:3031::6815:4808" } ], "dnssec_valid": false, "ip": "172.67.173.102", "whois": { "registrar": "Sollutium EU sp. z o.o.", "created": "2025-12-11T06:13:11Z", "updated": "2025-12-11T19:16:38Z", "expires": "2026-12-11T06:13:11Z", "nameservers": [ "milan.ns.cloudflare.com", "samara.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T19:45:43Z", "analysis_at": "2026-10-20T18:49:07Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 5, "suspicious": 1, "undetected": 33 }, "detections": { "CRDF": "malicious", "VIPRE": "malware", "Webroot": "malicious", "SOCRadar": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "created": "2025-12-11T00:00:00Z", "updated": "2025-12-11T00:00:00Z", "first_seen": "2025-12-11T19:39:17Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "milan.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.72.8" }, { "ttl": 21600, "type": "NS", "value": "samara.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.173.102" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:4808" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:ad66" }, { "ttl": 21600, "type": "NS", "value": "milan.ns.cloudflare.com" } ], "dns_at": "2026-10-20T18:49:27Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "usd-qr-code.com", "*.usd-qr-code.com" ], "issuer": "Google Trust Services / WE1", "serial": "70888cd5ebbae7b1376895d8264926b", "sha256": "250c109f8f4db8d10541a99bc4a4f3a2712902244acff1d2babddfec07b4d973", "subject": "usd-qr-code.com", "valid_to": "2027-01-01T18:59:00Z", "valid_from": "2026-10-03T18:01:13Z" }, "rdap": { "status": [ "active" ], "events": { "expiration": "2026-12-11T06:13:11Z", "last changed": "2026-10-08T01:16:06Z", "registration": "2025-12-11T06:13:11Z", "registrar expiration": "2026-12-11T06:13:11Z", "last update of RDAP database": "2026-10-14T15:36:05Z" }, "registrar": "SOLLUTIUM LLC", "registrar_iana_id": "4545" } } } ```