What Gridinsoft observed on Qrcc.me
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260904210915-19660f3e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- QR Redirect Service — Exact-Code Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The operator root is a QRCodeChimp shortener and did not itself present a phishing workflow. Public sandboxes preserve exact historical QR-code abuse, but current replay found a mix of removed codes, changed destinations, an unavailable destination, and one unresolved destination rather than a reproducible whole-domain phishing object. The current Gridinsoft report has no broad Phishing category, while a fresh VirusTotal snapshot still displays a Gridinsoft phishing row without an exact object. Because this is an unbounded mutable redirect namespace, the correct current conclusion is inconclusive and exact-code-dependent, not a domain-wide Safe certification and not a domain-wide phishing claim based solely on a blacklist category.
Analyst findings
Review 7 documented observations View evidence
The operator root returned HTTP 200 and identified qrcc.me as the URL-shortener host for QR codes created on QRCodeChimp. It linked to qrcodechimp.com and contained no login, credential request, automatic unrelated redirect, executable or archive delivery, or malware payload.
-
HTTP status
200 -
Final URL
https://qrcc.me/ - Page element This is a URL Shortener site for QR Codes that are created on QRCodeChimp.
- Public artifact URL https://www.qrcodechimp.com/
- Analyst observation The root is an operator surface, not a directory or representative sample of user-created QR destinations.
The exact QR URL highlighted by a February 2026 sandbox remained active. Its current redirect script exposed http://onelink.to/ceb_app, which returned HTTP 307 to the Nexent Bank App page. The current chain did not present a fake login, credential receiver, automatic executable or archive download, malware file, payload, or hash.
-
HTTP status
200 -
Redirect destination
http://onelink.to/ceb_app -
Final URL
https://www.nexentbank.de/nexent-bank-app/ - Page element Nexent Bank App
- Analyst observation No current impersonated sign-in form, credential receiver, executable or archive delivery, malware payload, or hash was reproduced in this exact chain.
Public sandboxes preserved object-specific abuse context for several exact codes. /sl53e61zxm5l was associated with a phishing chain to deltaegyplast.com and now returns HTTP 404. /skqmwin7ifd5 appeared in a phishing-tagged Triage record and now returns HTTP 404. /s4o6ten8tlcv still exposes https://adpbidfilesecure.nl/D/DOC.html, but that destination did not resolve during this review. These are exact-code findings, not evidence that every QR code or the operator root is malicious.
- Public artifact URL https://any.run/report/f4e1f669c14ab0c5dd76d4d4039f8a4bf956c80c7434a8a20b2d305eca383b52/e7397e98-c721-4a76-9636-4ba4904aba56
- Public artifact URL https://tria.ge/
- Public artifact URL https://any.run/report/d5daeabbf65f20f841ae0aa15ac804f42b754e51a5d14a79ca114b11ecf51138/0e0cde32-6b3a-4db8-adc1-09edf2b298fa
- Analyst observation Current replay returned 404 for /sl53e61zxm5l and /skqmwin7ifd5.
-
Redirect destination
https://adpbidfilesecure.nl/D/DOC.html - DNS fact adpbidfilesecure.nl did not resolve during the current review.
The exact code /sbdemb09bqiv, referenced by a 2024 phishing-tagged sandbox, currently returned a QR redirect page naming a perspectivefunnel.co destination. The destination returned an access-challenge response during this review, so its underlying current content and forms were not assessed and no current harmful or clean conclusion was assigned to this object.
-
HTTP status
200 -
Redirect destination
https://perspectivefunnel.co/660d5b5a5497a20014c8d18b/660d5b86647c1c001499f582/ - Public artifact URL https://any.run/report/107218d78a4ba9148c2cddd62b75d185b29a584999adf11fa921cecda81518fa/476b2e41-6b58-4123-9078-167a8a1d3421
- Analyst observation The destination's underlying current content was not available for direct assessment; this object remains unresolved rather than classified clean or harmful.
urlscan reported 490 public records and its current 100-result page contained no result-level malicious verdict. OTX exposed one 2024 Phishing Army blocklist pulse and 117 URL observations; none of the available OTX URL rows carried a Google Safe Browsing match. Public search also returned several exact-code sandbox records. The Internet Archive CDX service and Common Crawl index were unavailable during this pass; the prior signed review recorded 324 distinct successful Wayback URL records from 2022 through 2025.
- Public artifact URL https://urlscan.io/domain/qrcc.me
- Public artifact URL https://otx.alienvault.com/indicator/domain/qrcc.me
- Public artifact URL https://web.archive.org/web/*/qrcc.me/*
- Analyst observation urlscan reported 490 total public records; the returned recent 100-result page exposed no result-level malicious verdict.
- Analyst observation OTX returned 117 URL observations and one broad 2024 blocklist pulse; none of the available URL rows contained a Google Safe Browsing match.
- Analyst observation Unavailable archive interfaces were treated as unknown; prior signed archive counts were retained only as historical context.
The current Gridinsoft public report did not show an active Phishing or other broad security category for qrcc.me. A fresh VirusTotal domain snapshot nevertheless still displayed the Gridinsoft row as phishing. This is a broad cross-platform classification discrepancy and does not identify an exact QR code, destination, phishing form, credential receiver, malware file, payload, or hash.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/qrcc-me
- Public artifact URL https://www.virustotal.com/gui/domain/qrcc.me
- Page element The current Gridinsoft report does not display an active Phishing category.
- Analyst observation The current VirusTotal domain snapshot retained a broad Gridinsoft phishing row without naming an exact QR object or observed harmful behavior.
qrcc.me is a mutable user-controlled redirect namespace without a complete public directory. Destinations can be changed, removed, conditioned on client context, or kept private. A clean operator root and finite current sample cannot support a whole-domain Safe verdict, while a historical sandbox label or bare domain blacklist category cannot establish that every QR code is phishing.
- Analyst observation The operator root states that qrcc.me hosts QRCodeChimp QR links, and exact QR pages expose independently selected destinations.
- Analyst observation The complete private, unindexed, deleted, conditional, geographic, device-dependent, and future QR-code namespace is not publicly enumerable.
- Analyst observation Every reported QR URL requires review of its exact current redirect chain and destination.
Scope and limitations
- The review covered the operator root, the exact code raised by the prior public sandbox, four additional exact sandbox-indexed codes, exposed redirect scripts, representative destinations, current public Gridinsoft and VirusTotal state, urlscan, OTX, public sandbox indexes, and available archive interfaces.
- The complete private, unindexed, deleted, conditional, account-bound, geographic, device-dependent, changed, and future QR namespace cannot be publicly enumerated.
- The perspectivefunnel.co destination named by /sbdemb09bqiv returned an access-challenge response, so its underlying current content and forms were not assessed and the object remains unresolved.
- The adpbidfilesecure.nl destination named by /s4o6ten8tlcv did not resolve, so its current content could not be tested; the dead destination is not treated as proof of current phishing or safety.
- The Internet Archive CDX and Common Crawl interfaces were unavailable during this pass. Earlier signed archive counts were used only as historical context, and unavailable sources were treated as unknown rather than clean.
- Public scanner, sandbox, threat-intelligence, and archive indexes are finite. A current harmful or clean verdict for any QR code requires its exact URL, redirect chain, final destination, and observable behavior.
Help protect others by sharing this page on social media! The more people who know about qrcc.me, the fewer chances they have to deceive someone else. Help others evaluate qrcc.me by sharing this page on social media!