solana-qr-code-printer[.]vercel[.]app

This domain, solana-qr-code-printer.vercel.app, operates as a high-risk brand impersonation platform designed to deceive users of the Solana blockchain. The site presents itself as a legitimate QR code generator for Solana payments, but analysis indicates it is engineered to intercept or redirect cryptocurrency transactions. Victims are likely to scan generated QR codes believing them to be valid payment requests, only to have funds diverted to attacker-controlled wallets. The threat extends beyond simple deception, as the infrastructure may also deploy crypto drainer scripts to automatically siphon assets from connected wallets without explicit user approval. Infrastructure analysis reveals multiple red flags confirming malicious intent. The domain was registered on January 28, 2020, through Vercel Inc., yet it remains active despite its age and known abuse. Only 1 of 95 security vendors on VirusTotal currently flags the domain, suggesting either low detection rates or recent evasion tactics. The site resolves to IP address 216.198.79.67, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. It is listed on three security blocklists, including those maintained by cryptocurrency security entities, and its SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. The page title, 'Solana QR Code Generator | Create Payment QR Codes,' directly mimics official Solana branding to enhance credibility. Users who have visited solana-qr-code-printer.vercel.app or interacted with its generated QR codes should take immediate action. Disconnect all wallet connections from the site and revoke any permissions granted via wallet interfaces. Scan all devices used to access the domain for malware, focusing on browser extensions or scripts that may persist. Monitor Solana wallet activity for unauthorized transactions, particularly those involving small test amounts or large outgoing transfers. If funds were lost, report the incident to blockchain analytics platforms and local cybercrime authorities, providing transaction hashes and timestamps. Avoid reusing the device for cryptocurrency transactions until a full security audit is completed, as residual threats may remain active.