solana-qr-code-generator[.]com

Analysis indicates that solana-qr-code-generator.com is actively hosting a cryptocurrency‑related impersonation site targeting the Solana brand. The domain was registered on 17 June 2025 through NiceNIC International Group Co., Limited and resolves to IP 104.21.112.1, an address owned by Cloudflare (AS13335) located in the United States. The site is served over HTTPS using a Google Trust Services / WE1 certificate, and Cloudflare’s DNS infrastructure (jo.ns.cloudflare.com, will.ns.cloudflare.com) is in place. HTTP requests return status 200 and the page advertises itself with the title “Solana QR Code Generator — Create SOL Address QR with Solana Logo”, directly referencing the Solana brand. Technical fingerprinting reveals the use of cdnjs, Clipboard.js and HTTP/3, all typical of modern web stacks, but does not provide evidence of malicious code beyond the branding misuse.

Reputation checks show a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that 2 of 95 scanning engines flag the site, indicating at least limited detection of malicious behavior. The classification in the intelligence set is “Crypto Scam” and “brand impersonation”, confirming that the operator likely aims to lure users into generating QR codes that could be exploited for credential or fund theft.

Uncertainty remains regarding the exact payload delivered to visitors; the current data set does not include samples of scripts, redirects, or credential‑harvesting mechanisms. Defenders should therefore treat any interaction with the domain as high‑risk. Recommended mitigations include adding the domain to network‑level deny lists, updating web‑filtering rules to block URLs containing “solana-qr-code-generator.com”, and monitoring for any outbound connections to the IP address 104.21.112.1.