coin-qrs[.]to

The domain coin-qrs.to has been identified as a confirmed brand impersonation threat specifically targeting Ethereum users. This phishing site is currently offline, having been taken down after security researchers flagged its malicious intent. The domain was registered through the Government of Kingdom of Tonga on April 27, 2024, and was assigned the IP address 45.12.2.86. Despite its page title claiming to be a "Bitcoin QR Code Generator Online," the site was actually designed to impersonate Ethereum, likely to steal cryptocurrency credentials or deploy a crypto drainer.

Technical analysis reveals significant red flags. The domain was flagged by 12 out of 95 security vendors on VirusTotal, indicating a high level of malicious detection. It also appears on one security blocklist. The SSL certificate was issued by Let's Encrypt (R13), which is commonly abused by phishing sites due to its free and automated issuance. The domain's recent creation date and the use of a Tongan registrar further suggest intentional obfuscation by threat actors. PhishDestroy's investigation confirms that this site posed a direct risk to Ethereum users, as it attempted to harvest sensitive information through deceptive branding.

Given that coin-qrs.to is now offline, the immediate threat has been mitigated. However, users should remain vigilant as similar domains may appear under different names. PhishDestroy recommends that anyone who interacted with this site—especially by entering credentials or connecting a wallet—should take immediate action: change passwords, revoke wallet permissions, and monitor accounts for unauthorized activity. To stay safe, always verify domain authenticity by cross-referencing with trusted sources like PhishDestroy before engaging with cryptocurrency-related sites.