# www.iscrow.xyz — SUSPICIOUS

> iscrow.xyz is a phishing domain currently offline. Avoid interacting with it as it poses risks of credential theft and impersonation attacks.

## Summary
PhishDestroy identifies iscrow.xyz as a low-risk phishing domain that was active briefly before being taken offline. This domain was flagged on one security blocklist and scanned by VirusTotal, where only 2 out of 95 vendors detected it as malicious. The domain resolved to the IP address 188.114.97.3 and displayed a page titled 'Just a moment...', which is often used to simulate legitimate waiting or loading screens, potentially to trick users or automated detection systems.

The phishing attempt likely involved impersonation via delay tactics on the landing page to create a false sense of legitimacy. By mimicking normal page load behavior, the site may have aimed to lower user suspicion and capture sensitive information once the full phishing content was unlocked. Although detailed impersonation targets are unclear, users could be exposed to credential harvesting or other scams if they engaged further with the site prior to its offline status.

If users visited iscrow.xyz, it is recommended to immediately change any passwords entered on the site and enable multi-factor authentication on affected accounts. Running a comprehensive malware and credential check is prudent, alongside monitoring financial and personal accounts for suspicious activity. Avoid revisiting the domain since it remains flagged and could resurface or redirect to similar malicious content.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Page title: Just a moment...

## Domain Intelligence
- Registered: 2026-03-07 17:07:01
- Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
- Country: IN
- IP: 188.114.97.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["amos.ns.cloudflare.com", "maya.ns.cloudflare.com"]
- SSL Issuer: none

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["Forcepoint ThreatSeeker", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://i.ibb.co/yB61c19R/fd80c170f237.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/bc772ec4-d5da-4a00-9709-bb3ebe4ae7c2
- Wayback Machine: https://web.archive.org/web/https://www.iscrow.xyz
- PhishDestroy: https://phishdestroy.io/domain/www.iscrow.xyz/
- LLM endpoint: https://phishdestroy.io/domain/www.iscrow.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/www.iscrow.xyz/
Last updated: 2026-03-19