scan-across[.]cam

This domain, scan-across.cam, is flagged as a high-risk generic phishing threat targeting users through a fake document sharing portal. Analysis indicates no direct association with a specific brand, but the site mimics legitimate file-sharing platforms to harvest credentials or distribute malware. No evidence of a crypto drainer kit has been observed, though credential theft remains the primary objective based on observed page structures and form submissions. Infrastructure analysis reveals the domain was registered on May 25, 2026, through Dynadot LLC, an uncommon creation date suggesting potential domain age manipulation. It resolves to the IP address 104.21.44.126, a Cloudflare-associated endpoint often used to obfuscate hosting origins. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious, while it appears on one additional security blocklist. The domain employs a Let's Encrypt SSL certificate (serial number E8), providing HTTPS encryption to lend false legitimacy to the phishing pages. The domain remains active as of the latest verification, with no takedown or sinkholing observed. It is currently blocked by at least one security feed, though the low detection rate suggests limited visibility. Users are advised to treat any interaction with scan-across.cam as malicious, particularly links or attachments claiming to be shared documents. Network-level blocking of the IP 104.21.44.126 and domain-based filtering are recommended to mitigate exposure. Persistent monitoring for related domains registered through Dynadot LLC with similar naming patterns (e.g., scan-[random].cam) is advised due to the high risk of recurring threats.