fantcsc[.]com

Analysis indicates that the domain fantcsc.com is actively engaged in brand impersonation targeting Scroll, as evidenced by its page title 'BILLING SUPPORT' and explicit classification in threat intelligence sources. The domain was registered on February 24, 2025, through Amazon Registrar, Inc., and currently resolves to the IP address 54.148.9.185, hosted on infrastructure associated with Amazon Web Services. Detection data reveals the domain is flagged by two security blocklists, including PhishDestroy and BLP-Malware, and appears in 23 threat intelligence pulses on AlienVault OTX. Gridinsoft assigns a trust score of 0/100, while Scamadviser rates it at 41/100, reflecting low confidence in its legitimacy. Two of 95 security vendors on VirusTotal have flagged the domain as malicious. Technologies detected on the domain include Bootstrap, Nginx, jQuery, OWL Carousel, Genesys Cloud, and AWS Certificate Manager, suggesting a structured phishing infrastructure. The SSL certificate is issued by Amazon, which may lend superficial legitimacy but does not mitigate the confirmed malicious intent. As of July 12, 2026, the domain remains active, posing an ongoing risk to users who may mistake it for official Scroll billing or support channels. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where Scroll-related services are utilized. Further investigation into associated IP ranges and registrar activity may uncover additional related infrastructure. The exact content and functionality of the site have not yet been analyzed, but the available evidence confirms its classification as a high-risk phishing domain.