etherscann[.]io

The domain etherscann.io was registered on 21 February 2026 and is currently taken offline. DNS resolution points to the IPv6 address 2606:4700:10::6814:1e38, which belongs to AS13335 operated by Cloudflare, Inc., locating the host in the United States. The TLS certificate presented by the server is issued to server1.bitaffs.com, a mismatch that frequently appears in malicious deployments. The site’s HTML title reads "Instant Cryptocurrency Exchange | Best Rates & Lowest Fees | ChangeNOW", a phrasing commonly used by fraudulent crypto‑exchange lures.

Intelligence categorises the activity as a "Fake Exchange" scam, and the domain is listed on two public blocklists: PhishDestroy and CryptoFirewall. VirusTotal analysis shows a single detection out of 93 scanners, indicating at least one security vendor has flagged the site as malicious. No additional public reports or OTX entries were observed for etherscann.io, and the page content has not been captured in this briefing.

The combination of a recent registration date, use of a Cloudflare‑provided address, mismatched certificate, and inclusion on dedicated crypto‑phishing blocklists suggests a purposeful attempt to impersonate a legitimate exchange service. Defenders should continue to block the domain at perimeter filters, monitor for any re‑appearance of the host or associated sub‑domains, and correlate any inbound traffic to the IPv6 address with known malicious patterns. Because the site is offline, ongoing verification of the payload or credential‑harvesting mechanisms is not possible, and further investigation should focus on the hosting infrastructure, certificate issuance chain, and any observed client‑side artifacts that may have been delivered before takedown.