usdtqrcodegenerator[.]com

PhishDestroy identifies usdtqrcodegenerator.com as an active crypto drainer domain designed to trick users into generating malicious QR codes for USDT wallet transactions. The site impersonates legitimate USDT QR code generation services to deceive cryptocurrency users into unknowingly approving fraudulent transactions that drain their wallets. No specific drainer kit has been publicly dissected, but the domain's operational behavior aligns with known crypto drainer toolkits that manipulate QR code generation to exfiltrate wallet credentials or approve malicious transactions.

This domain was flagged on VirusTotal with a detection rate of 2/95 security vendors, indicating low but present recognition of its malicious nature. Technical indicators include resolution to IP address 188.114.97.3, a Let's Encrypt SSL certificate, registration through SOLLUTIUM LLC on March 26, 2026, and an elevated risk status. The domain has not been flagged by Google Safe Browsing (GSB) but remains unlisted on major blocklists, suggesting new or recently activated infrastructure. These factors contribute to its elevated risk profile and potential for rapid expansion in crypto-focused phishing campaigns.

As of the latest assessment, usdtqrcodegenerator.com remains active and poses an elevated threat to cryptocurrency users seeking QR code generation tools. Immediate action is required to block this domain at the network and endpoint levels to prevent wallet drain attacks. Users should avoid interacting with this domain and verify the legitimacy of QR code generation services through official channels. The remaining risk is high due to the domain's recent activation, low initial detection rate, and targeted nature against USDT users. Continuous monitoring and proactive blocking are essential to mitigate potential financial losses.