Question 1

What is quishing?

Accepted Answer

Quishing is QR-code phishing: an attacker prints, stickers, emails, or DMs a QR code that, when scanned, opens a credential-harvesting page, a wallet-drainer transaction, an open WiFi trap, or an Android intent that sideloads malware. The QR itself is just an image, so traditional email-link filters and browser warnings never see it until the victim's phone has already opened the destination. The defense has to happen at scan time, before the phone follows the link.

Question 2

How is quishing different from regular phishing?

Accepted Answer

Three differences. First, the attack vector is physical or visual, a sticker over a parking-meter QR, a printed flyer impersonating an MFA enrollment, a restaurant menu QR replaced overnight, so it bypasses email gateways entirely. Second, victims trust QR codes more than they trust links in email; a QR feels like a destination chosen by whoever printed the surface, not a stranger's URL. Third, dynamic QR codes that route through a shortener can be repointed at a phishing destination after the printed asset has been distributed, so a QR that was safe at print time can become hostile months later. Static link-scanners don't catch that, they answer 'is this URL malicious right now', not 'who can change where this points'.

Question 3

How do I check a QR code is safe before scanning?

Accepted Answer

Don't point your phone's native camera at it, that opens the destination immediately. Instead, open check.qr.abundera.ai on your phone, scan the QR through the in-page camera (decoding happens locally; the image never leaves your device), and read the verdict. We walk every redirect hop, classify whether the destination is controllable by a third party after the QR was printed (the mutability axis), and check reputation against Google Safe Browsing and other aggregators. Cleared verdicts are safe to open; Caution and Do-not-proceed verdicts tell you why.

Question 4

What are real-world quishing examples?

Accepted Answer

Parking-meter and EV-charger stickers that overlay the legitimate QR with one pointing to a credit-card-harvesting page (the most-reported pattern of 2024-2025, observed in Austin, San Antonio, and across the UK). Restaurant menu QRs swapped to phishing pages overnight by an attacker physically replacing the table tent. Corporate MFA-enrollment flyers in office bathrooms that look official but enroll the attacker's device. Wedding-invitation QRs distributed months before the event, where a shortener-account compromise lets an attacker repoint thousands of printed cards. Crypto-payment QRs at point-of-sale terminals overlaid with the attacker's wallet address. The common thread: the printed QR looks identical to the safe one.

Question 5

How is this different from Google Safe Browsing or VirusTotal?

Accepted Answer

Existing tools classify whether a URL is currently malicious. We additionally classify whether the destination is controllable by a third party after the QR was printed, a property we call mutability. A clean dynamic QR routed through a shortener is still high-risk for a parking-meter sticker or wedding invitation: the shortener account holder can change the destination to a phishing page at any moment. We surface this control-posture signal as a first-class verdict field, alongside the threat-content verdict.

Question 6

What payload types are supported?

Accepted Answer

HTTP/HTTPS URLs, WiFi credentials (WIFI:), vCard and MeCard contact records, telephony URIs (tel:, sms:, mms:), mailto:, Android intent:// URIs, cryptocurrency URIs (bitcoin:, ethereum:, solana:, litecoin:, monero:, dogecoin:, tron:, ripple:, cardano:), content-addressed identifiers (magnet:, ipfs:, ipns:), inline data: URIs, calendar events (BEGIN:VEVENT / BEGIN:VCALENDAR), geo: URIs, Bluetooth pairing (BLUETOOTH: / BAU v1.0 Auracast), Matter onboarding (MT:), EMV payment QRs (SGQR / PromptPay / PayNow / DuitNow / UPI), WireGuard VPN configs, Smart Health Cards (shc:/), eSIM activation codes (LPA:), WalletConnect pairing (wc:), FIDO passkey cross-device (FIDO:), hard-blocked schemes (javascript:, file:, ftp:), and plain text with embedded URL / email / phone / crypto address extraction.

Question 7

Do you store the QR I scanned?

Accepted Answer

No. The decoded payload travels to our server over HTTPS so we can walk the redirect chain and query reputation databases, that's a functional necessity, not a choice, but it is never persisted. Verdicts are cached by a SHA-256 hash of a per-payload-type discriminator concatenated with a server-held secret salt; the original payload cannot be reconstructed from any cache entry. Logs (if enabled) record only the hash and the verdict.

Question 8

Is this free? What's the catch?

Accepted Answer

Anonymous use is free at 3 scans per IP per 24 hours, enough to check the QR you just scanned without signing up. Paid tiers (Personal $4.99, Family $12.99 for 5 seats, Starter $29, Pro $99, Business $499, Business Plus $799, Enterprise $2,500) raise the cap and add API access, mutation alerts, and paid reputation sources. Founding-member rates lock in 34% off forever, annual billing, available through September 1, 2026. Camera decoding in your browser is on the house, that's pure local compute and we don't meter it.

Question 9

Why a separate domain from qr.abundera.ai?

Accepted Answer

qr.abundera.ai is a generator that promises everything-client-side: nothing leaves your device. This safety checker transmits the decoded payload to the server by necessity. We separate the two surfaces so the client-only promise stays clean on the generator domain, and the inverted-privacy-model surface stays clearly labeled here.

Question 10

What's the mutation alert feature?

Accepted Answer

Pro tier feature (launching with Pro). When you submit a QR for tracking, we re-walk the chain on a periodic cadence and email you if the redirect targets, terminal destination, or the set of indirection-service operators changes. This catches the most common quishing pattern in the wild: print a clean QR, switch the destination to phishing months later, harvest scans from the printed asset.

Question 11

Can I embed this in my security product?

Accepted Answer

Yes, on the Pro tier. The API is RESTful, returns a structured JSON verdict with payload-type, threat-class, mutability, redirect chain, per-hop control attribution, and sub-payload findings. Designed for embedding in wallet apps, mobile security suites, enterprise URL filtering, and corporate Slack / Teams link-preview enrichers. API access ships with the Pro tier at $99/mo; see /pricing/.

Nie ufaj QR, dopóki nie zostanie zwolniony.

Zobacz, jak to działa

Jak to działa

Dekoduj

Dyspozycja

Śledź + klasyfikuj

Unifikuj

Co wyłapujemy, czego nie ma w narzędziach tylko-URL

Łańcuch przekierowań i zmienność

Kody QR konfiguracji WiFi

Drainery portfeli krypto

Komisjonowanie inteligentnego domu Matter

Podmiana płatności QR sprzedawcy EMV

Przejęcie konta przez logowanie QR

Dziś czysty QR, jutro strona phishingowa

Statyczny QR

Dynamiczny QR (ryzyko)

Cennik

Aplikacje natywne już wkrótce

Pytania