scroll-bridge[.]cfd

Analysis of scroll-bridge.cfd shows the domain was registered on 21 February 2026 and is currently taken offline. The domain resolves to IP address 188.114.97.3, which is hosted by Cloudflare, Inc. (AS13335) and geolocated in the United States. The TLS certificate presented is identified as WE1, indicating a standard Cloudflare‑issued certificate without additional validation. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the site’s legitimacy.

The page title returned from the live host, “Scroll - Bridge”, does not contain any direct reference to the targeted brand, but the intelligence flags the domain as impersonating Ethereum, classifying the activity as a crypto‑scam. The domain appears on one security blocklist and is specifically listed by PhishDestroy as malicious. VirusTotal reports that 13 of 93 scanning engines flagged the domain, providing independent confirmation of suspicious behavior. The combination of a newly created domain, a zero‑trust score, multiple vendor detections, and explicit blocklist listings strongly suggests that the site was used for fraudulent purposes targeting users of the Ethereum ecosystem.

Because the site is offline, content cannot be examined further, leaving the exact payload or credential‑harvesting mechanisms unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑use of the same IP range, and add the domain to internal threat‑intel feeds. Ongoing observation of Cloudflare‑assigned IPs associated with similar scams is recommended, as attackers often shift hosting while retaining the same certificate authority. Until further evidence emerges, the domain should be treated as a confirmed crypto‑scam targeting Ethereum users.