scandclanka[.]info

This domain, scandclanka.info, is identified as a high-risk credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the domain was designed to mimic legitimate services, tricking visitors into submitting sensitive credentials such as usernames, passwords, and potentially financial information. The presence of an open directory listing (Index of /) suggests incomplete or abandoned deployment, though prior versions likely hosted convincing replicas of corporate or financial institution login pages. Such infrastructure is commonly used in large-scale phishing campaigns to harvest credentials for subsequent fraud, account takeovers, or lateral movement in compromised networks. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on July 19, 2021, through eNom, LLC, a registrar frequently associated with abusive registrations. It resolves to the IP address 162.240.210.218, hosted on AS46606 (Unified Layer), an autonomous system with a history of hosting phishing and malware distribution sites. Detection metrics further substantiate the threat: 17 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on two independent security blocklists. Additional protections include blocking by PhishDestroy and PhishingDB, and classification as phishing by Google Safe Browsing. The domain’s SSL certificate, issued by Let’s Encrypt (R13), provides minimal encryption but does not mitigate the underlying threat. Users who visited scandclanka.info should take immediate remedial action to mitigate potential compromise. Any credentials entered on the site should be considered exposed and must be changed across all platforms where reused. Multi-factor authentication should be enabled on critical accounts to prevent unauthorized access. System scans using updated endpoint protection tools are recommended to detect potential malware or browser-based exploits. Network logs should be reviewed for connections to 162.240.210.218 or related domains registered through eNom. Organizations should update internal blocklists to include this domain and its associated IP to prevent future access. Given the domain’s current offline status, users should remain vigilant for similar phishing attempts using newly registered lookalike domains.