eterscan[.]io

The domain eterscan.io was first observed on July 12, 2026 and is currently flagged as a high‑risk brand‑impersonation site targeting Binance. The page title returned by the HTTP server reads “Instant Cryptocurrency Exchange | Best Rates & Lowest Fees | ChangeNOW,” which aligns with the declared scam type of cryptocurrency.

Technical probing shows the site responds with HTTP status 200 and presents an SSL certificate issued to server1.bitaffs.com. DNS resolution points to IP address 104.20.30.56, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The domain was registered on February 21, 2026. Reputation services assign a Gridinsoft trust score of 0 out of 100 and list the domain on a single security blocklist. VirusTotal analysis indicates that 1 of 95 scanned security vendors flagged the domain as malicious.

The low trust score, the presence of a mismatched SSL certificate, and the solitary blocklist entry suggest an infrastructure deliberately crafted to avoid detection while still hosting malicious content. The single vendor detection on VirusTotal may reflect limited exposure or evasion techniques, but the combination of high‑risk classification, active status, and confirmed impersonation of Binance warrants caution. No additional content analysis beyond the page title is available, leaving the exact landing page behavior uncertain.

Defenders should block or sinkhole traffic to eterscan.io at the network perimeter and update endpoint detection rules to include the associated IP 104.20.30.56. Continuous monitoring of DNS queries for this domain and related C‑name patterns is recommended. Since the site is already listed by PhishDestroy, integration of that feed into security tooling can provide early warning. Analysts should also watch for new domains that share the same SSL certificate or resolve to the same Cloudflare IP range, as they may be part of the same campaign.