toreador[.]io

The domain toreador.io was registered on May 27 2026 through Infomaniak Network SA. The site presents a page titled “Toreador - Crypto QR Code Generator”, suggesting a service that creates QR codes for cryptocurrency transactions. The domain is currently active and resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. in Canada.

Network analysis shows the domain serves HTTP responses with status code 200 and uses a Let’s Encrypt certificate (E7). The host is configured with Cloudflare nameservers gordon.ns.cloudflare.com and daniella.ns.cloudflare.com, and MX traffic is routed to mta-gw.infomaniak.ch (priority 5). Reputation scoring is extremely low, with Gridinsoft assigning 0 out of 100 and the domain appearing on one public blocklist. VirusTotal reports that 2 of 95 security vendors have flagged the domain, and it is listed as blocked by PhishDestroy.

While the site’s visual content mimics a legitimate QR‑code generator, no malicious payload has been observed in the delivered HTML, and the exact phishing technique employed remains unclear. The domain’s recent creation date and high risk rating indicate a deliberate attempt to lure cryptocurrency users, but the lack of additional indicators such as compromised credentials or exfiltration URLs limits the current attribution to a generic phishing campaign.

Defenders should treat toreador.io as hostile. Immediate actions include adding the domain to outbound web filters, updating DNS blocklists, and monitoring email traffic for references to the domain or its MX host. Continuous scanning of the IP 188.114.96.3 for new artifacts and periodic re‑evaluation of VirusTotal scores are recommended to capture any escalation. Given the high‑risk classification, organizations handling cryptocurrency transactions should enforce strict URL verification and educate users about unsolicited QR‑code requests.