bscscan[.]site

Analysis of bscscan.site indicates that the domain was actively used for a generic phishing operation before being taken offline. The site presented a minimal HTTP response with the page title "Index of /" and did not serve an SSL certificate, confirming the lack of encrypted traffic. Registration data shows the domain was created on May 26, 2025 through Go Daddy, LLC, and it resolves to the IPv4 address 5.182.208.60, which is assigned to AS62068 SpectraIP B.V. in the Netherlands. The hosting infrastructure is fronted by Cloudflare name servers kristin.ns.cloudflare.com and kurt.ns.cloudflare.com, a common tactic to obscure the true origin of malicious traffic.

The domain appears on a single security blocklist and has been blocked by the PhishDestroy mitigation service, confirming that at least one defensive platform recognized it as hostile. VirusTotal scans reported five detections out of ninety‑five antivirus engines, reinforcing the malicious classification. Additional reputation services assign extremely low trust scores: Scamadviser rates the domain 1 out of 100, and Gridinsoft scores it 0 out of 100, both indicating a high likelihood of abuse. AlienVault OTX references the domain in one threat‑intel pulse, providing further corroboration of its involvement in malicious campaigns.

The combination of low trust metrics, multiple vendor detections, and blocklist inclusion suggests a deliberate phishing infrastructure. Uncertainty remains regarding the specific lure or credential harvesting method employed, as no further page content has been disclosed. Defenders should continue to block the domain at network perimeters, update URL filtering feeds with the observed indicators, and monitor for any re‑registration or resurrection attempts. Incident response teams encountering related traffic should correlate logs with the observed IP address and Cloudflare name servers to isolate compromised endpoints.