qr-topayday1ra[.]com

PhishDestroy identifies qr-topayday1ra.com as an active phishing domain impersonating payday loan services to harvest sensitive financial data. This domain operates as a generic phishing page designed to deceive users seeking short-term loans, leveraging urgency and trust-building tactics to extract personal and banking information. The threat actor behind this domain employs a fraudulent user interface mimicking legitimate payday lenders, with no evidence of a drainer kit or advanced obfuscation techniques, indicating a low-to-moderate sophistication level. This domain was flagged with a VirusTotal score of 20/95 security vendors detecting malicious activity, indicating widespread recognition across threat intelligence platforms. The domain was registered on May 04, 2026, through Aceville Pte. Ltd., and resolves to IP address 34.44.237.96. The SSL certificate is issued by TrustAsia Technologies, Inc., which does not mitigate the phishing risk. Additionally, the domain is blocked by two major security blocklists, OpenPhish and PhishingArmy, and is flagged by Google Safe Browsing (GSB) as malicious. The domain’s recent creation date and active status suggest a time-sensitive threat requiring immediate attention. As of the latest assessment, qr-topayday1ra.com remains active and poses an elevated risk to users searching for payday loan services. Immediate response actions include blocking the domain at the network and endpoint levels, updating security blocklists, and issuing user advisories to avoid interactions with this fraudulent site. While the domain is currently under active monitoring, the risk of continued exploitation persists due to its recent deployment and the lack of advanced evasion techniques employed by the threat actor. Users are advised to exercise caution and verify the legitimacy of financial service websites before submitting sensitive information.