blockchain-scan[.]org

PhishDestroy’s anti-phishing unit has opened a forensic investigation into blockchain-scan.org, a recently activated domain masquerading as a blockchain explorer to harvest private wallet keys and seed phrases. The site’s lures reference generic cryptocurrency terms such as ‘scan’ and ‘blockchain,’ suggesting an attempt to impersonate legitimate blockchain explorers like Etherscan or Blockchain.com. No bespoke drainer kit hash or brand logo has been positively identified during initial crawling, but automated JavaScript payloads are under static analysis for obfuscated wallet-draining routines.

Technical indicators confirm the following footprint: VirusTotal detection score 0/95 (no AV flags), TLS certificate issued by Let’s Encrypt on IPv4 216.198.79.1, domain name registered through NameCheap, Inc. on March 21, 2026, and a total of zero blocklist inclusions at time of writing. Google Safe Browsing currently holds no verdict for the URL, leaving browsers and security products unaware of the threat. The combination of a fresh registration, low VT coverage, and absence from global blocklists lowers the immediate detection surface and elevates the operational risk.

The domain remains ACTIVE and under INVESTIGATION; PhishDestroy has escalated SHA-256 artifacts to CERT partners and added the IP to our real-time sinkhole feed. While risk posture is currently assessed as under_investigation, the low detection baseline and phrasing strongly indicate an imminent shift to high severity once drainer payloads are confirmed. Users are advised to block 216.198.79.1 at the network perimeter, avoid clicking any blockchain-scan.org links, and verify explorer URLs via official project channels before entering private keys.