etehrscan[.]io

The domain etehrscan.io is a confirmed phishing site engaged in brand impersonation targeting cryptocurrency users. It mimics the Binance exchange to deceive victims into believing they are interacting with a legitimate platform, posing an elevated risk of credential theft and financial fraud. No cryptocurrency drainer kit was identified, but the site was actively used for cryptocurrency-related scams before being taken offline.

Technical indicators confirm the malicious nature of etehrscan.io. The domain was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, which assigned a trust score of 0/100. It appears on 2 security blocklists, PhishDestroy and CryptoFirewall, and was not flagged by Google Safe Browsing. The domain was created on February 21, 2026, and resolves to the IP address 172.66.171.200, hosted on Cloudflare's network in the US. The SSL certificate is issued by server1.bitaffs.com, and the observed page title was 'Instant Cryptocurrency Exchange | Best Rates & Lowest Fees | ChangeNOW'. Scamadviser assigned a trust score of 12/100 to the domain.

Users who interacted with etehrscan.io should immediately change any passwords or credentials entered on the site and enable two-factor authentication on their accounts. If cryptocurrency transactions were attempted, revoke any token approvals and consider moving funds to a new wallet to prevent unauthorized access. Report the phishing domain to relevant authorities, such as the impersonated brand's security team, and submit the URL to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to help prevent further victimization.