blendqr[.]com

blendqr.com is currently offline, but historical data indicates it was used in a crypto‑related brand‑impersonation campaign targeting users of Ethereum. The domain was registered on 3 May 2025 through NiceNIC International Group Co., Limited and is delegated to Cloudflare name servers bill.ns.cloudflare.com and sima.ns.cloudflare.com. DNS resolution points to 172.67.159.247, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site presented a page titled “Crypto QR Generator & Mixer – BTC, ETH, XMR, USDT, USDC, LTC”, suggesting a QR‑code generation and mixing service for multiple cryptocurrencies, a common lure for victims seeking to move funds anonymously. No TLS certificate was observed, indicating that connections would have been made over plain HTTP or an untrusted HTTPS configuration.

Reputation services assign the domain a trust score of 1 / 100 on both Scamadviser and Gridinsoft, reflecting extreme suspicion. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal analysis reports five detections out of ninety‑five scanners, confirming that multiple security vendors have identified malicious characteristics. The combination of low trust scores, blocklist presence, and vendor detections provides concrete evidence of malicious intent.

Given the current offline status, defenders should continue to monitor the underlying IP address for potential reuse, enforce DNS‑level blocking of 172.67.159.247, and add blendqr.com to internal blocklists to pre‑empt re‑activation. Network sensors should be configured to alert on any outbound connections attempting to resolve the domain or its associated IP. Because the site purportedly impersonated the Ethereum brand, any communications referencing Ethereum QR codes or mixers should be treated with heightened scrutiny.