coin-qr[.]to

coin-qr.to is a malicious website that poses as a legitimate Bitcoin QR code generator, but its real purpose is to impersonate Ethereum and trick users into connecting their crypto wallets or revealing sensitive information. This type of scam, often called a crypto drainer, can lead to the theft of digital assets if a user interacts with the site. The domain was created on January 8, 2024, and was registered through the Government of the Kingdom of Tonga, an unusual registrar choice that often indicates an attempt to evade takedown. Security vendor analysis on VirusTotal shows that 14 out of 95 engines flag the domain as malicious, and it is currently listed on 5 security blocklists. The site has no SSL certificate, meaning any data transmitted is unencrypted and vulnerable to interception. It resolves to IP address 45.12.2.86, and has been found in 2 threat intelligence pulses on AlienVault OTX, confirming its connection to broader phishing campaigns. While the site is currently offline, users who visited it should take immediate action. Do not enter any sensitive information or connect any cryptocurrency wallet to suspicious sites. Run a full antivirus scan on your device, monitor your crypto accounts for unauthorized transactions, and change any passwords that may have been reused on the site. If you suspect funds were stolen, contact your wallet provider or exchange immediately. Always verify website legitimacy through trusted sources like PhishDestroy before engaging with crypto-related services.