etner-scan[.]xyz

PhishDestroy identifies etner-scan.xyz as an active fake system scanner phishing domain designed to deceive users into downloading malicious software under the guise of a security scan. The domain is currently flagged by 1 of 95 VirusTotal security vendors, indicating limited but present detection coverage. This threat poses an elevated risk to unsuspecting users who may interact with the spoofed scanning interface.

This domain was flagged by 1 of 95 VirusTotal security vendors, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 188.114.96.3 and holds a valid SSL certificate issued by Google Trust Services. The domain was created on January 27, 2025, making it a recently deployed threat infrastructure. While VirusTotal detection remains low, the presence of a legitimate SSL certificate could enhance user trust and facilitate successful phishing delivery. Additionally, the domain’s short operational history suggests it may not yet be widely recognized by blocklists despite its active status.

Given the active status of etner-scan.xyz and its use of a deceptive system scanner interface, users should treat this domain with extreme caution. It is strongly recommended that individuals and organizations block access to etner-scan.xyz at the network level and update firewall rules to prevent outbound connections. Security teams are advised to scan endpoints for signs of interaction with this domain, particularly any downloads or redirections initiated through fake scan prompts. Users encountering unsolicited system scan alerts should verify the legitimacy of the source through official software channels and avoid entering any credentials or downloading files from suspicious domains.