qrco[.]de

qrco.de is currently observed serving a single HTTP 302 redirect that lands on a page titled “Just a moment…”. The redirect originates from IP address 13.33.187.122, which is mapped to a United States location within the Amazon CloudFront network. The TLS handshake presents an Amazon RSA 2048 M04 certificate, indicating the site is using Amazon‑issued TLS infrastructure. Network analysis shows the domain resolves exclusively to the CloudFront IP and leverages Cloudflare Browser Insights, Cloudflare services, and HTTP/3. These layers provide content delivery and performance optimization while also obscuring the true origin of the payload. The domain was registered on 24 March 2026, and its status remains active as of the report date, 12 July 2026. Open‑source threat feeds have recorded the domain in 27 AlienVault OTX pulses and on three public blocklists (PhishDestroy, ScamSniffer, CryptoFirewall). VirusTotal scans have resulted in six of ninety‑five security vendors flagging the host, and Gridinsoft assigns a trust score of ten out of one hundred. The observed behavior, combined with the classification “Crypto Drainer (wallet extracted)”, suggests the site is used to lure victims into authorizing cryptocurrency transactions that divert funds to attacker‑controlled wallets. While the redirect and hosting details are well documented, the exact payload delivered after the initial page and the specific wallet addresses targeted have not been publicly disclosed. Defenders should block DNS resolution for qrco.de, enforce strict outbound controls on cryptocurrency‑related API calls, and monitor for any anomalous HTTP/3 traffic to the identified IP. Continuous re‑evaluation of threat‑intel feeds is advised to capture any evolution of the infrastructure or additional indicators of compromise.