# PhishDestroy domain threat record: ethersscan.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ethersscan.net/
Machine-readable companion: https://phishdestroy.io/domain/ethersscan.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 13:12:14 UTC
- Last availability or vendor check: 2026-10-22 13:12:14 UTC
- Stored record updated: 2026-10-22 16:30:29 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Etherscan

## Stored infrastructure

- Observed IP address: 65.21.102.3
- Registrar in stored WHOIS data: Squarespace Domains LLC
- Registrar country in stored WHOIS data: US
- Registration date (registry RDAP, ethersscan.net): 2026-10-14 14:57:03 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a163bc-5073-703b-8806-ad8861d8c1e9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ethersscan.net
- Certificate Transparency search: https://crt.sh/?q=%25.ethersscan.net
- Web Archive lookup: https://web.archive.org/web/*/https://ethersscan.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classifies ethersscan.net as an impersonation phishing page. The site was first observed by PhishDestroy on 2026-10-22, returning HTTP 200 with no page title captured. Intake was triggered because VirusTotal reported two malicious detections from phishing‑focused vendors.

How the scam works
Attackers register look‑alike domains and host pages that copy the look and wording of a trusted service—in this case the popular blockchain explorer etherscan.io. The fake page typically solicits login credentials, private keys, or wallet connection approvals, which can then be harvested to hijack accounts or drain funds.

Evidence
VirusTotal scanned the domain on 2026-10-19 and flagged it as malicious by alphaMountain.ai and Forcepoint ThreatSeeker, with a third engine marking it suspicious, for a total of 2 malicious and 1 suspicious detections out of 92. Google Safe Browsing checked on 2026-10-22 did not flag the URL, while the external SEAL blocklist listed it and PhishDestroy’s internal list also contains the domain. OTX recorded four pulses referencing the domain as of 2026-10-22. urlscan.io captured the site on 2026-10-22, reporting a high malicious score (97) from its engine set, though its overall verdict was non‑malicious.

Infrastructure
The domain was recorded pointing to 65.21.102.3, an address belonging to Hetzner Online GmbH (ASN 24940) in Finland, and the scan observed ports 22 and 80 open. Registration occurred on 2026-10-14 through Squarespace Domains LLC, DNSSEC was enabled, and the nameservers were nsb1‑nsb4.squarespacedns.com.

What to do
Users should avoid entering any credentials, private keys, or approving wallet connections on ethersscan.net. Organizations should block the domain at network perimeters, add it to threat‑intel feeds, and review logs for connections to the host.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a163bc-5073-703b-8806-ad8861d8c1e9/
Cloudflare Radar report: https://radar.cloudflare.com/scan/f8620a75-e939-451a-b0ef-afd0b6697f7f
URLQuery report: https://urlquery.net/report/0c99915d-f8ab-4af0-b7f8-deb46049467f
Stored capture screenshot: https://i.ibb.co/mCPfhVYn/f9b443cf3024.png
Cloudflare Radar screenshot (2026-10-22T13:48:45Z): https://screenshots.phishdestroy.io/cf/f8620a75-e939-451a-b0ef-afd0b6697f7f.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/0c99915d-f8ab-4af0-b7f8-deb46049467f.png
VirusTotal report: https://www.virustotal.com/gui/domain/ethersscan.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ethersscan.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 16:24:40 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/mCPfhVYn/f9b443cf3024.png
  Captured: 2026-10-22 13:12:14 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a163bc-5073-703b-8806-ad8861d8c1e9.png
  Captured: 2026-10-22 13:12:14 UTC
  Source report: https://urlscan.io/result/01a163bc-5073-703b-8806-ad8861d8c1e9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f8620a75-e939-451a-b0ef-afd0b6697f7f.png
  Captured: 2026-10-22 13:48:45 UTC
  Source report: https://radar.cloudflare.com/scan/f8620a75-e939-451a-b0ef-afd0b6697f7f
  SHA-256: 41b4cb33c473da88bd1af8f500fb1a6699e666c6ecc94cfb31ff3910e068669a
- URLQuery: https://screenshots.phishdestroy.io/uq/0c99915d-f8ab-4af0-b7f8-deb46049467f.png
  Source report: https://urlquery.net/report/0c99915d-f8ab-4af0-b7f8-deb46049467f
  SHA-256: 63a7df0cb31e4dd475ebae5260950da1afd10cddba66315f10a0337364b5a675

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T13:50:51Z",
        "uuid": "01a163bc-5073-703b-8806-ad8861d8c1e9",
        "scanned_at": "2026-10-22T13:10:54Z",
        "final_url": "http://ethersscan.net/",
        "status": 200,
        "redirects": [
            {
                "to": "https://ethersscan.net/",
                "from": "http://ethersscan.net/",
                "status": 307
            },
            {
                "to": "http://ethersscan.net/",
                "from": "https://ethersscan.net/",
                "status": 307
            }
        ],
        "ip": "65.21.102.3",
        "ptr": "static.3.102.21.65.clients.your-server.de",
        "ips": [
            "65.21.102.3"
        ],
        "asns": [
            "24940"
        ],
        "countries": [
            "FI"
        ],
        "link_domains": [
            "etherscan.io",
            "info.etherscan.com",
            "docs.etherscan.io",
            "chat.blockscan.com",
            "sepolia.etherscan.io",
            "hoodi.etherscan.io",
            "twitter.com",
            "medium.com",
            "www.facebook.com",
            "www.reddit.com",
            "trust.etherscan.io",
            "status.etherscan.io",
            "blockscan.com"
        ],
        "social": [
            "https://twitter.com/etherscan",
            "https://medium.com/etherscan-blog",
            "https://www.facebook.com/etherscan"
        ],
        "doc_hash": "b650f99ab80ed5f13d8391798f62011a845cf3c5e9a051ff62cb596e15974394",
        "script_hashes": [
            "7c0be00bfd43494dcddc8817168e952d9900555c3e80355686a423eedd2bab22",
            "b496666d915d2fc366157003b3074c2200271949afc510c20681c126efba2a17",
            "f2e1d3493610754734401dc19b21931b78af0e07824dfa44489dbcd9a6a2676a",
            "67f763499997c497317fc08d170c3c8040891a8bbd2603939429a59cbad83771",
            "8bbb58cbfd4633c1d828c6bc37bc32abc768a149c01b1dfc4f5131fd81274551",
            "dc0d3c2fce2e22c57f40a4ba0404279623d2334888be8b18d95c8cace85595a2",
            "f4a828255ab321d96cbcc9dd8b56a7ee50304818fd17a46336677669cc1c24e1",
            "f4badb505a66652af948c8a9a3d098cfab66e384d0a2d6cd956e3d5f3b1b07ef",
            "06e6e11b3cd45de086ee03bed5099d04fd8829c1dc0a84abdd0046411b26616d",
            "f5f2f251cf0b672066bc5145a8be87d485193cef262ddbabc1b053f11395f2d2"
        ],
        "globals": [
            "TURBOPACK",
            "__next_f",
            "next",
            "__webpack_hash__"
        ],
        "storage_keys": [
            "__es_probe__",
            "wagmi.store",
            "rk-version",
            "es-network-stats"
        ],
        "domain_age_days": 7,
        "apex_age_days": 7,
        "requests": 31,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000",
            "content-security-policy": "frame-ancestors 'none'",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T14:22:41Z",
        "uuid": "f8620a75-e939-451a-b0ef-afd0b6697f7f",
        "scanned_at": "2026-10-22T13:48:45Z",
        "final_url": "https://ethersscan.net/",
        "history": [
            {
                "url": "https://ethersscan.net/",
                "status": 0
            }
        ],
        "dom_hash": "433a5e367a2aeb4769756ee4cc70d4ffb3e81ed2c2fddf9de5834d9d14dd2a4d",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ethersscan.net",
                "type": "A",
                "value": "65.21.102.3"
            }
        ],
        "dnssec_valid": true,
        "whois": {
            "registrar": "Squarespace Domains LLC",
            "created": "2026-10-14T14:57:03Z",
            "updated": "2026-10-14T15:03:18Z",
            "expires": "2027-10-14T14:57:03Z",
            "nameservers": [
                "nsb1.squarespacedns.com",
                "nsb2.squarespacedns.com",
                "nsb3.squarespacedns.com",
                "nsb4.squarespacedns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T16:23:18Z",
        "analysis_at": "2026-10-19T06:28:33Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 2,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "Squarespace Domains LLC",
        "created": "2026-10-14T14:57:03Z",
        "expires": "2027-10-14T14:57:03Z",
        "updated": "2026-10-14T15:03:18Z",
        "first_seen": "2026-10-14T18:25:20Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nsb3.squarespacedns.com"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 -all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nsb4.squarespacedns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nsb2.squarespacedns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nsb1.squarespacedns.com"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "cloud-dns-hostmaster.google.com",
                "value": "nsb1.squarespacedns.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "65.21.102.3"
            }
        ],
        "dns_at": "2026-10-19T06:58:17Z",
        "whois": {
            "registrar": "Squarespace Domains LLC",
            "registrar_iana_id": "3827",
            "registrar_url": "http://squarespace.domains",
            "created": "2026-10-14T14:57:03Z",
            "updated": "2026-10-14T15:03:18Z",
            "expires": "2027-10-14T14:57:03Z",
            "status": [
                "client",
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "nsb1.squarespacedns.com",
                "nsb2.squarespacedns.com",
                "nsb3.squarespacedns.com",
                "nsb4.squarespacedns.com"
            ],
            "dnssec": "signedDelegation"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-14T14:57:03Z",
                "last changed": "2026-10-14T15:03:18Z",
                "registration": "2026-10-14T14:57:03Z",
                "registrar expiration": "2027-10-14T14:57:03Z",
                "last update of RDAP database": "2026-10-14T15:03:18Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:51:31Z",
        "mail_config": {
            "spf": "v=spf1 -all",
            "dmarc": true,
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "ethersscan.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "ports": {
            "open": [
                22,
                80
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "216.239.34.107",
                    "host": "nsb2.squarespacedns.com"
                },
                {
                    "ip": "216.239.38.107",
                    "host": "nsb4.squarespacedns.com"
                },
                {
                    "ip": "216.239.32.107",
                    "host": "nsb1.squarespacedns.com"
                },
                {
                    "ip": "216.239.36.107",
                    "host": "nsb3.squarespacedns.com"
                }
            ],
            "zone": "ethersscan.net"
        },
        "location": {
            "ip": "65.21.102.3",
            "asn": "24940",
            "org": "Hetzner Online GmbH",
            "city": "Helsinki",
            "country": "FI"
        },
        "dns": {
            "A": [
                "65.21.102.3"
            ],
            "NS": [
                "nsb2.squarespacedns.com",
                "nsb4.squarespacedns.com",
                "nsb1.squarespacedns.com",
                "nsb3.squarespacedns.com"
            ],
            "SOA": "{\"nsname\": \"nsb1.squarespacedns.com\", \"hostmaster\": \"cloud-dns-hostmaster.google.com\", \"serial\": 1, \"refresh\": 21600, \"retry\": 3600, \"expire\": 259200, \"minttl\": 300}",
            "TXT": [
                "v=spf1 -all"
            ]
        },
        "dnssec": {
            "ds": true,
            "rrsig": true,
            "dnskey": true
        },
        "get_ip": {
            "ip": "65.21.102.3",
            "family": 4
        },
        "whois": {
            "registrar": "Squarespace Domains LLC",
            "created": "2026-10-14T14:57:03Z",
            "updated": "2026-10-14T15:03:18Z",
            "expires": "2027-10-14T14:57:03Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "nsb1.squarespacedns.com",
                "nsb2.squarespacedns.com",
                "nsb3.squarespacedns.com",
                "nsb4.squarespacedns.com"
            ]
        }
    }
}
```