iscanxonline[.]top

The domain iscanxonline.top is identified as a confirmed phishing site targeting users of cryptocurrency portfolio tracking services. Analysis indicates the site impersonates SolRay, a legitimate multi-chain portfolio tracker, to deceive victims into disclosing sensitive credentials or installing malicious software. The domain is currently offline, but prior activity suggests it was actively used for credential harvesting or wallet-draining attacks under the guise of a trusted financial tool. Infrastructure analysis reveals multiple high-risk indicators. The domain was flagged by 16 of 95 security vendors on VirusTotal, appears on four security blocklists, and is blocked by platforms such as MetaMask and PhishDestroy. It resolves to the IP address 172.67.169.217, hosted behind Cloudflare’s infrastructure, which is commonly exploited to obscure malicious origins. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 27, 2026, the domain exhibits an unusually recent creation date for a purported financial service, further indicating fraudulent intent. Additional technical indicators include a Gridinsoft trust score of 0/100 and the use of Cloudflare Browser Insights, a technology often leveraged to monitor victim interactions. Current status confirms the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the threat persists as similar domains may emerge using identical tactics. Users are advised to verify the legitimacy of any cryptocurrency-related service by cross-referencing official sources and avoiding domains with recent registration dates or low trust scores. Organizations should update security blocklists to include the IP address 172.67.169.217 and monitor for related infrastructure, such as newly registered domains under the same registrar or resolving to the same IP range. Immediate reporting to relevant security platforms is recommended to prevent further exploitation.