scanbsc[.]io

This domain is flagged for brand impersonation targeting Binance, presenting an elevated risk to cryptocurrency users. Analysis indicates the domain scanbsc.io mimics Binance’s official wallet security reporting interface, specifically referencing the BNB Smart Chain in its page title, "Wallet Security Report | BNB Smart Chain." The intent is to deceive users into disclosing credentials or transferring assets under false pretenses.

Infrastructure analysis reveals the following technical indicators: the domain was registered on January 31, 2025, through NameCheap, Inc., and resolves to the IP address 216.150.1.1. It is currently offline but was previously detected by 13 out of 95 security vendors on VirusTotal, appearing on at least one security blocklist (PhishDestroy). The domain employs Nginx and OpenResty web technologies, which are commonly used in both legitimate and malicious infrastructure. Additional risk scoring metrics include a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk.

Mitigation steps for this threat type include immediate blocking of the domain and associated IP (216.150.1.1) at the network perimeter. Organizations should update endpoint protection rules to flag or quarantine any attempts to access scanbsc.io. Users who may have interacted with the domain should revoke active sessions, rotate credentials, and monitor accounts for unauthorized transactions. Security teams are advised to review logs for connections to the IP or domain, particularly those involving cryptocurrency wallets or financial applications. Given the domain’s recent creation and offline status, continuous monitoring for re-emergence or similar spoofing attempts is recommended.