bromptonsciences[.]com

Analysis of bromptonsciences.com shows a high‑risk, active crypto‑scam infrastructure that impersonates the Ethereum brand. The domain was registered on February 12, 2024 through Cloudflare, Inc., and its authoritative name servers are brenna.ns.cloudflare.com and nitin.ns.cloudflare.com, indicating that the attacker is leveraging Cloudflare’s DNS and CDN services. DNS resolution points to IP address 104.21.32.1, which belongs to AS13335, Cloudflare, Inc., located in the United States. The site presents an HTTP status code 530, a non‑standard response that may be used to obscure normal traffic patterns. SSL is provided by Google Trust Services / WE1, confirming that a valid certificate is in place, but this does not mitigate malicious intent.

The page title returned by the server is "Arkham Exchange," and the site advertises technologies typical of modern web applications, including Node.js, React, Next.js, Google Sign‑in, HSTS, Google Tag Manager, Google Analytics, and Twitter Ads. These components suggest a sophisticated front‑end that can collect credentials or redirect users while maintaining a legitimate‑looking security posture. Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records 13 detections out of 95 scanned engines, confirming malicious classification by multiple vendors. The domain appears on at least one security blocklist and is actively blocked by the PhishDestroy service, reinforcing its status as a confirmed threat. The threat actor’s primary objective is brand impersonation of Ethereum, classified as a crypto‑scam, likely intended to lure users into providing wallet credentials or sending funds.

While the exact phishing page content has not been publicly disclosed, the combination of a legitimate‑looking SSL certificate, modern web stack, and brand‑related page title indicates a high probability of credential‑harvesting or fund‑diversion activity.