play-mavia[.]com

Analysis of the domain play-mavia.com indicates it was actively impersonating the Across protocol, a known Web3 bridging platform, as part of a cryptocurrency scam. The domain was registered on February 21, 2026, and resolved to Cloudflare infrastructure (AS13335) via IPv6 address 2a06:98c1:3121::3, hosted in the United States. The SSL certificate was issued under the E1 root, a common configuration for Cloudflare-managed domains. The page title, 'Mavia - Web3 App | Heroes of Mavia,' suggests an attempt to mimic a gaming or DeFi application, though the exact content and functionality remain unconfirmed due to the domain's current offline status.

The domain appeared on one security blocklist and was flagged by PhishDestroy. VirusTotal reported a detection from 1 of 93 security vendors, indicating limited but present malicious classification. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk designation. No additional details regarding the scam mechanics, such as wallet addresses or transaction prompts, are available.

Defenders should treat this domain as a confirmed brand impersonation threat targeting Across users, particularly those involved in Web3 or cryptocurrency transactions. Network-level blocking of the domain and associated IP is recommended, alongside monitoring for related infrastructure reuse under new domains. The domain's takedown reduces immediate risk, but similar campaigns may emerge using comparable naming conventions or hosting patterns.