usdt-erc20-qr-code-generator[.]com

The domain usdt-erc20-qr-code-generator.com is identified as a brand impersonation threat specifically targeting Ethereum users. Analysis indicates the site masquerades as a legitimate USDT ERC20 QR code generator, a service commonly used for cryptocurrency transactions. Currently, the domain is offline, but prior activity suggests malicious intent to deceive users into exposing wallet addresses or private keys. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious activity. It was registered through NiceNIC International Group Co., Limited and resolved to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). The domain was created on February 21, 2026, and appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the underlying threat. These indicators collectively point to a coordinated effort to impersonate Ethereum-related services for fraudulent purposes. As of the latest assessment, usdt-erc20-qr-code-generator.com has been taken offline, likely due to enforcement actions or voluntary takedown. Users are advised to treat any prior interactions with the domain as compromised and to verify the authenticity of cryptocurrency tools through official channels. Wallet addresses or credentials entered on such sites should be considered exposed, and affected users should monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.