scanusdt[.]org

scanusdt.org was observed hosting a cryptocurrency‑related brand impersonation campaign targeting the CS:GO community. The site was registered on 21 February 2026 through Web Commerce Communications Limited dba WebNic.cc and uses the nameservers ns100.webnic.cc and ns101.webnic.cc. DNS resolution points to the IP address 194.87.110.74, which belongs to ASN 48347 operated by JSC Mediasoft ekspert in Russia. An SSL certificate identified as “R11” is present, but the site is currently taken offline, and HTTP probes return no active content. The page title returned by the server is “AML Check”, a generic term often associated with anti‑money‑laundering checks, but no further page content has been captured.

Reputation services have flagged the domain. PhishDestroy and ScamSniffer list it as a confirmed malicious site, and it appears on two additional security blocklists. VirusTotal scans show that one of ninety‑five antivirus engines flagged the domain, indicating at least minimal malicious behavior. AlienVault OTX records a single threat‑intel pulse referencing the domain, reinforcing the classification as a crypto scam.

The elevated risk rating reflects the brand impersonation of CS:GO and the potential for financial loss. Uncertainties remain regarding the exact phishing kit or the specific user‑interaction flow, as no live page was available for analysis. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts on related IP ranges, and advise users, especially those active in the CS:GO ecosystem, to disregard any unsolicited communications referencing “AML Check” or similar terminology. Ongoing observation of the hosting ASN and registrar may reveal future campaigns using the same infrastructure.