tron-qr-code-generator[.]org

This domain, tron-qr-code-generator.org, is flagged as an active crypto drainer phishing site targeting TRON (TRX) wallet users. Analysis indicates the site impersonates a legitimate QR code generator to deceive victims into exposing private keys or signing malicious transactions, enabling unauthorized fund transfers. The page title, 'TRON QR Code Generator | Create Free TRX Wallet QR Codes,' directly mimics TRON-branded services, a common tactic in cryptocurrency-related fraud to exploit user trust in familiar interfaces. Infrastructure analysis reveals the domain was registered on May 19, 2026, through Tucows Domains Inc., an unusually future-dated creation that may indicate bulk registration or evasion techniques. It resolves to IP address 216.198.79.1, hosted in the US under Lefkoff Industries, a provider frequently associated with malicious infrastructure. The domain is flagged by 1 out of 95 security vendors on VirusTotal, while appearing on three independent blocklists. SSL certification is provided by Let’s Encrypt (R13), a legitimate but often abused service for phishing sites. No Google Safe Browsing (GSB) detection is currently recorded, though this does not preclude active malicious use. As of the latest verification, tron-qr-code-generator.org remains active and unmitigated, posing a high risk to users interacting with TRON wallets or QR-based transaction tools. Response actions by security entities include blocking by PhishDestroy, MetaMask, and SEAL, though the domain continues to resolve. Users are advised to treat any interaction with this domain as a direct threat to wallet security. Immediate measures include blacklisting the domain and IP in endpoint protection systems, revoking any associated wallet permissions, and verifying transaction signatures through trusted interfaces. The future-dated registration and lack of widespread detection suggest potential for prolonged abuse, warranting ongoing monitoring of related infrastructure.