solana-sol-qr-code-generator[.]com

This domain, solana-sol-qr-code-generator.com, poses a direct threat as a crypto drainer impersonating the Solana blockchain platform. Analysis indicates the site presented itself as a legitimate QR code generator for SOL wallet addresses, complete with logo integration, to deceive users into exposing private keys or signing malicious transactions. Such tactics are commonly associated with wallet-draining malware, where victims unknowingly authorize fund transfers to attacker-controlled addresses under the guise of utility tools. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on August 18, 2025, through NiceNIC International Group Co., Limited, and currently resolves to IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Security vendors on VirusTotal flagged the domain at a ratio of 15/95, while five independent blocklists—PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB—have listed it as malicious. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing domains frequently use valid encryption to appear legitimate. Users who visited solana-sol-qr-code-generator.com or interacted with its content should take immediate remediation steps. Disconnect any wallets from the site, revoke all connected dApp permissions, and transfer remaining funds to a new, secure wallet address. Monitor transaction history for unauthorized activity and scan local devices for malware using updated security tools. If private keys or seed phrases were entered, consider the original wallet compromised and avoid further use. Report the incident to relevant blockchain security teams for further investigation and potential asset recovery.