mon-qr-code-generator[.]com

This domain is flagged as an elevated-risk brand impersonation site designed to deceive users of the Across protocol. Analysis indicates the site masquerades as a legitimate QR code generator for Across wallet addresses, a common vector for crypto address substitution attacks. The domain specifically targets users by offering an "Instant MON Address QR Maker," likely intended to trick victims into generating QR codes that redirect funds to attacker-controlled wallets instead of legitimate Across addresses. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on November 14, 2025, through SOLLUTIUM LLC and currently resolves to IP address 104.21.87.22. It is detected by 4 out of 95 security vendors on VirusTotal and appears on three security blocklists, including MetaMask, SEAL, and PhishDestroy. The domain holds a Gridinsoft trust score of 0/100, reinforcing its malicious classification. Technical fingerprinting identifies the use of Nginx, Cloudflare, jQuery, HSTS, cdnjs, and Clipboard.js, suggesting a professionally crafted phishing kit designed to mimic legitimate crypto tools. Mitigation steps for users and security teams include immediate blocking of the domain and its associated IP address (104.21.87.22) at the network level. Users should verify the authenticity of any QR code generator by cross-referencing with official Across documentation or support channels. Wallet providers are advised to flag or warn users attempting to interact with this domain. Security teams should monitor for related infrastructure, including domains with similar naming patterns (e.g., "mon-qr," "across-generator") and registrations through SOLLUTIUM LLC, which may indicate additional impersonation attempts. If funds were sent to addresses generated via this site, users should treat the transaction as compromised and report it to their wallet provider and relevant blockchain analysis platforms.