qr-topayday9ty[.]com

This domain, qr-topayday9ty.com, is flagged as an elevated-risk phishing site specializing in QR code payment fraud. Analysis indicates the site presents a Japanese-language interface prompting users to scan a QR code with their smartphones, likely redirecting to credential harvesting or unauthorized transaction pages. The specific threat involves tricking victims into executing payments or divulging sensitive financial information under the guise of a legitimate transaction process. Infrastructure analysis reveals the domain was registered on May 08, 2026, through Aceville Pte. Ltd., an uncommon registrar for fraudulent activity. It resolves to IP address 34.44.237.96, hosted on a cloud provider in the US (Google Cloud, us-central1). The site appears on one security blocklist and is blocked by at least one enterprise-grade filtering system. VirusTotal detection rates show 19 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 intermediate, a common choice for both legitimate and fraudulent sites due to its low-cost issuance. Mitigation steps for this threat type include blocking the domain and its resolving IP at network perimeter devices. Organizations should update endpoint protection rules to detect and prevent access to the domain, particularly on mobile devices where QR code scanning is prevalent. Security teams are advised to monitor for connections to 34.44.237.96 and alert on any attempts to access qr-topayday9ty.com. User awareness training should emphasize verifying payment requests, especially those initiated via QR codes, and reporting suspicious activity immediately. Given the domain's current offline status, continued monitoring for re-emergence is recommended.