qr[.]fm

PhishDestroy has identified qr.fm as a brand impersonation threat, meaning it mimics a legitimate brand to trick you into sharing sensitive information like passwords or credit card numbers. This domain is particularly dangerous because it's designed to look trustworthy at first glance, but its sole purpose is to deceive visitors. Even though the site is now offline, it still poses a residual risk to anyone who visited it earlier.

Our analysis shows that qr.fm was registered through NameCheap, Inc. on September 7, 2020, and its SSL certificate was issued by Google Trust Services. The domain resolves to IP address 172.67.165.152 and appears on two security blocklists. VirusTotal flags it as malicious, with 10 out of 95 security vendors marking it as dangerous, and AlienVault OTX has detected it in 18 threat intelligence pulses. The page title was “What is qr.fm?” which is deliberately vague to avoid raising suspicion.

If you visited qr.fm, take immediate action: change any passwords you may have used, enable two-factor authentication on your accounts, and monitor your financial statements for unusual activity. Run a full antivirus scan on your device and consider using a password manager to avoid reusing credentials. Stay safe by always verifying URLs before entering personal information.