QR Phishing Analyser

QR PHISHING ANALYSIS REPORT ============================ Report ID: QRP-2026-0087 Analyst: SOC Team Date: 2026-07-31 14:22:00 UTC DECODED CONTENT =============== Content Type: URL Decoded Value: http://185.220.101.45/login/verify?token=abc123 Character Count: 43 Decode Status: Success WARNING: The decoded destination has not been opened. DESTINATION OVERVIEW ==================== Full URL: http://185.220.101.45/login/verify?token=abc123 Protocol: http (unencrypted) Hostname: 185.220.101.45 (raw IPv4) Port: (default) Path: /login/verify Query Params: 1 URL Shortener: No Punycode: No Raw IP: Yes (IPv4) RISK SCORE =========== Score: 55 / 100 Risk Level: Suspicious Explanation: Multiple static indicators suggest this destination warrants investigation before any access. This does not confirm maliciousness. DETECTED SECURITY SIGNALS ========================== 1. [HIGH] Raw IP destination Evidence: Host: 185.220.101.45 Legitimate services use domain names, not raw IP addresses. 2. [MEDIUM] HTTP instead of HTTPS Evidence: Protocol: http:// No encryption — credentials entered here would be transmitted in cleartext. 3. [MEDIUM] Suspicious path/query keywords Evidence: Path contains: login, verify Credential-harvesting path keywords commonly used in phishing kits. RECOMMENDED NEXT STEPS ====================== 1. Do not open the URL on a normal workstation 2. Submit the URL to an approved sandbox or reputation service 3. Investigate whether the QR came from an email, document, poster, or package 4. Search proxy, DNS, email, and endpoint logs for access to the domain 5. Ask the affected user whether they scanned the QR code 6. Determine whether credentials or payment information were entered 7. Revoke sessions and reset credentials if account data was submitted 8. Validate the domain using approved threat intelligence 9. Escalate when multiple high-risk indicators are present ANALYST SUMMARY =============== Static analysis of the QR-decoded URL http://185.220.101.45/login/verify identified 3 security signals including a raw IPv4 destination, unencrypted HTTP transport, and credential-harvesting path keywords. The risk score of 55 falls in the Suspicious range. Further investigation is required. This does not confirm maliciousness — the destination has not been opened. Triaged via SOC.Workflows — socworkflows.com/qr-phishing DISCLAIMER: This score is based on static URL characteristics and does not confirm whether the destination is malicious.