URLScan [1] shows the site hosted on DDoS-Guard which is a Russian company. Only ESET [2] detects as "suspicious" so the scam site is doing a good job hiding.

URLScan [1] shows the site hosted on DDoS-Guard which is a Russian company. Only ESET [2] detects as "suspicious" so the scam site is doing a good job hiding. Their javascript resources are hosted in OVH. It also appears they have many different domains on the same IP with ark in the name. [3] It seems only their DNS is hosted on CloudFlare. [1] - https://urlscan.io/result/610d159a-1c1b-46fb-b999-d957f801efc9/ https://urlscan.io/result/610d159a-1c1b-46fb-b999-d957f801ef... [2] - https://www.virustotal.com/old-browsers/url/9b54144ea2a3413e24b85be52e6458946180365751b024f07e5e260a12ba9ad8 https://www.virustotal.com/old-browsers/url/9b54144ea2a3413e... [3] - https://urlscan.io/result/610d159a-1c1b-46fb-b999-d957f801efc9/related/ https://urlscan.io/result/610d159a-1c1b-46fb-b999-d957f801ef...