iscans[.]link

This domain, iscans.link, operates as a fraudulent cryptocurrency portfolio tracker designed to deceive users into disclosing wallet credentials or executing malicious transactions. Analysis of the site's content and infrastructure indicates it mimics legitimate multi-chain portfolio management tools, likely targeting users of decentralized finance (DeFi) platforms. The page title, 'iScans - Multi-Chain Portfolio Tracker,' aligns with common phishing tactics used to exploit trust in blockchain-related services, where victims may unknowingly authorize transactions or reveal private keys to attackers.

Technical evidence confirms the malicious nature of iscans.link. The domain is flagged by 5 out of 95 security vendors on VirusTotal, including detections for phishing and fraudulent activity. It was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. The domain appears on three security blocklists and resolves to the IP address 170.75.164.161, which has been linked to other phishing campaigns. Detected technologies include Nginx and HTTP Strict Transport Security (HSTS), suggesting an attempt to appear legitimate while concealing malicious intent.

Users who visited iscans.link should take immediate action to mitigate potential risks. If wallet credentials, seed phrases, or private keys were entered, the affected wallet should be considered compromised. Users are advised to transfer assets to a new wallet, revoke any suspicious smart contract approvals, and monitor transaction histories for unauthorized activity. Additionally, affected systems should be scanned for malware, as phishing sites may distribute additional payloads. Browser data, including cached credentials, should be cleared to prevent further exposure. Given the domain's elevated risk level and offline status, users should remain vigilant for similar threats targeting cryptocurrency users.