qprchs[.]bar

The domain qprchs.bar is a confirmed phishing site engaged in brand impersonation targeting Revolut users. It presents itself as a legitimate Revolut portal to deceive victims into entering login credentials or personal information, posing an elevated risk of financial fraud or identity theft. No crypto drainer kit was detected, but the site was active until recently and has since been taken offline.

Technical analysis shows qprchs.bar was registered on February 25, 2026, through Gname.com Pte. Ltd. and resolved to the IP address 104.21.39.51, hosted on Cloudflare’s network in the US. At the time of assessment, 2 of 95 VirusTotal security vendors flagged the domain, while Google Safe Browsing had not yet marked it as malicious. The domain appeared on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'AXENDRA'. The site used Cloudflare and HTTP/3 technologies, and a Gridinsoft trust score of 0/100 further confirms its malicious nature.

Individuals who interacted with qprchs.bar should immediately change their Revolut account password and enable two-factor authentication if not already active. Monitor account activity for unauthorized transactions and report any suspicious charges to Revolut support. Victims can also report the phishing domain to Google Safe Browsing, their local cybercrime unit, or platforms like PhishTank to help prevent further abuse. If financial data was exposed, consider placing a fraud alert on credit reports.