btc-qrs[.]to

The domain btc-qrs.to was registered on 1 May 2024 through a registrar identified as the Government of Kingdom of Tonga. It resolves to the IPv4 address 45.12.2.86, which is assigned to AS6698 (Virtual Systems LLC) and geolocated to Ukraine. The authoritative nameservers are ns1.zomro.net and ns2.zomro.ru, both typical of low‑cost hosting providers. HTTP requests are terminated by an Nginx front‑end protected by Cloudflare CDN, and the site served a valid Let’s Encrypt R12 certificate. Front‑end libraries observed include jQuery, cdnjs and Clipboard.js, and the response headers indicate HTTP Strict Transport Security (HSTS) enforcement.

The only visible content reported by passive crawlers is the page title “Bitcoin QR Code Generator”, suggesting an attempt to lure victims interested in cryptocurrency transactions. The brand target is explicitly listed as Bitcoin, and the scam classification is “Crypto Scam”. No additional page content has been disclosed, so the exact user‑facing layout remains unverified. Reputation services rate the domain poorly: Scamadviser assigns a trust score of 6 / 100, while Gridinsoft reports 0 / 100. VirusTotal analysis shows that 15 of 95 antivirus engines flagged the domain, indicating a substantial detection rate.

The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy service. As of the report date (23 July 2026) the site is reported offline, which may be a temporary takedown or a change in hosting. Defenders should continue to block the host IP (45.12.2.86) and the domain name, monitor the associated nameservers for re‑registration, and update URL filtering rules to include the observed page title. Email gateways and web proxies should flag any outbound traffic to btc-qrs.to as malicious, especially communications that reference Bitcoin QR code generation.