# iscanlive.fun — SUSPICIOUS

> iscanlive.fun masquerades as a free online scanner, but 2 of 95 VirusTotal vendors flag it as credential-stealing infrastructure; avoid entering any data.

## Summary
PhishDestroy identifies iscanlive.fun as an active credential-stealing fake scanner portal. The domain is currently distributing malicious content designed to harvest user credentials under the guise of an online security scanner.  iscanlive.fun was flagged by 2 of 95 VirusTotal vendors on day one of operation. Registrant details show the domain was created on March 28, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP 188.114.97.3 secured by a Let's Encrypt SSL certificate.  Threat status remains active. PhishDestroy recommends blocking the domain at DNS and firewall layers, refraining from visiting or submitting data, and updating threat intelligence feeds with indicator 1528e2. Monitor endpoints for outbound callbacks to 188.114.97.3 and inspect TLS certificates for Let's Encrypt issuer O=Let's Encrypt, CN=R3 to detect related campaigns.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-28 16:53:04
- Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/c3a4e7bf-5816-487c-ac69-0f3277a36bd8
- PhishDestroy: https://phishdestroy.io/domain/iscanlive.fun/
- LLM endpoint: https://phishdestroy.io/domain/iscanlive.fun/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/iscanlive.fun/
Last updated: 2026-04-12