scroll[.]exchange

PhishDestroy first observed scroll.exchange on Jun 14, 2026. The hostname explicitly references Scroll; stored content metadata identifies the same apparent target. Stored page analysis classifies the content as fake exchange. Current evidence score: 76/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, MetaMask, and SEAL. VirusTotal recorded 3 detections among 91 engines: CRDF, Gridinsoft, SOCRadar on Aug 2, 2026 at 02:12 UTC. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 22:20 UTC. Non-positive and contextual checks: AlienVault OTX listed 1 community pulse reference (not vendor detections) on Jun 3, 2026 at 05:11 UTC. Google Safe Browsing returned no flag on Jun 3, 2026 at 05:00 UTC.

HTTP 302 was recorded on Aug 7, 2026 at 22:47 UTC. Registration records for the domain list Amazon Registrar, Inc. as the registrar and May 18, 2026 as the creation date. Registration preceded first observation by 27 days. At collection time, the hostname resolved to 187.77.66.108 on AS47583 (Hostinger International Limited). The recorded endpoint location is Frankfurt am Main, DE. The stored server header is nginx/1.28.3 (Ubuntu).

Neither a page title nor a landing-page capture is stored. The content indicators and 3 positive source findings support the current Scroll-themed fake exchange classification.