solanaqrcode[.]hk

On 22 July 2026, solanaqrcode.hk was identified as an active brand‑impersonation site targeting Solana users. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 80.94.92.202, which is allocated to AS47890 UNMANAGED LTD in Romania. The hosting environment runs Ubuntu with an Apache HTTP Server, WordPress, MySQL, PHP, and the Yoast SEO plugin; the site serves over HTTPS using a Let’s Encrypt certificate (subject E7) and returns HTTP 200 for the landing page whose title is “Solana QRcode – solanaqrcode.hk”. DNS is delegated to ns3.my-ndns.com and ns4.my-ndns.com.

Reputation data show a Gridinsoft trust score of 0 / 100 and the domain is listed on at least one security blocklist; it is also blocked by the PhishDestroy service. AlienVault OTX references the domain in a single threat‑intelligence pulse, and VirusTotal scans report that five of ninety‑one scanners flagged the domain as malicious. The combination of a newly created domain, low trust score, active blocklist entries, and multiple vendor detections indicates a high‑risk infrastructure that is likely being used to lure cryptocurrency users into fraudulent QR‑code interactions.

At present, the specific content hosted on the page has not been publicly disclosed, and the exact phishing workflow remains unknown. Defenders should add the domain and its associated IP address to blocklists, enforce DNS sink‑hole policies for the listed nameservers, and monitor outbound traffic for attempts to resolve or contact the host. Continuous re‑scanning with multi‑vendor services is recommended to capture any changes in the site’s behavior, and any observed credential or wallet‑address submissions should be reported to the Solana security team for further investigation.