qrperfect-automation[.]onrender[.]com

The domain qrperfect-automation.onrender.com is currently active and classified as a high-risk brand impersonation threat specifically targeting Trust Wallet. Analysis confirms this domain mimics the legitimate Trust Wallet platform, a well-known cryptocurrency wallet service, to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. The page title 'Shared Document' further suggests an attempt to lure victims through deceptive document-sharing tactics, a common social engineering technique in financial fraud schemes. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain is flagged by 3 of 95 security vendors on VirusTotal, indicating detection by established threat intelligence systems. It appears on two independent security blocklists, including PhishDestroy and ScamSniffer, and is hosted on an IP address (216.24.57.8) associated with Render Services Inc. (AS397273), a US-based provider. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as fraudulent domains frequently leverage valid certificates to appear legitimate. No creation date is provided, but the domain's active status and recent detection patterns suggest recent deployment. Current evidence confirms qrperfect-automation.onrender.com remains operational and poses a significant risk to users. Organizations and individuals are advised to block this domain at the network level and implement real-time monitoring for related indicators of compromise. Users should verify the authenticity of any communication claiming to originate from Trust Wallet by accessing the official website directly and avoiding interaction with unsolicited links or shared documents. Security teams are encouraged to correlate this domain with other known Trust Wallet impersonation campaigns and update detection rules to include the associated IP address and SSL certificate fingerprint.