tron-qr-code-generator[.]com

The domain tron-qr-code-generator.com is currently active and hosts a page titled “TRON QR Code Generator — Create TRX Address QR with TRON Logo”. The site was registered on August 11, 2025 through NiceNIC International Group Co., Limited and resolves to 172.67.198.198, an address owned by Cloudflare (AS13335) located in the United States. The server presents a valid SSL certificate issued by Google Trust Services / WE1 and returns HTTP 200 for requests. Infrastructure analysis shows the domain is served by Cloudflare name servers bill.ns.cloudflare.com and sima.ns.cloudflare.com. Threat intelligence indicates the site is a high‑risk crypto scam that impersonates the Near brand. The page title and brand target suggest the operator is attempting to lure Near users into interacting with a fraudulent TRON QR‑code service. The domain appears on five public blocklists and has been flagged by multiple security products: 18 of 95 VirusTotal scanners have raised detections, Gridinsoft assigns a trust score of 0 / 100, and AlienVault OTX references the domain in fifteen pulses. Additionally, wallet extensions including MetaMask, Polkadot, PhishDestroy, SEAL and Enkrypt have blocked the site. While the exact malicious payload or credential‑harvesting mechanisms have not been publicly disclosed, the convergence of brand impersonation, a valid SSL certificate, and widespread blocklist inclusion strongly supports a classification as a crypto‑related impersonation scam. Defenders should add tron‑qr‑code‑generator.com to DNS and URL filtering policies, monitor for traffic to its IP address, and consider broader heuristics that flag Near‑related brand misuse. Ongoing observation of any new infrastructure or payload changes is recommended.