rank[.]sky-frag[.]cc

This domain, rank.sky-frag.cc, is flagged for brand impersonation targeting the Across platform, a known decentralized protocol. Analysis indicates the site masqueraded as an esports league under the title 'National league Esports,' likely to deceive users into engaging with fraudulent content or disclosing sensitive information. No crypto drainer kit signatures were identified, but the impersonation tactic aligns with credential theft or social engineering campaigns. The domain exhibits no legitimate affiliation with Across or recognized esports organizations, reinforcing its fraudulent nature. Infrastructure analysis reveals the domain was created on October 8, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk registrations. It resolves to the IP address 172.67.207.158, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to conceal origin servers. The domain lacks an SSL certificate, a red flag for user security, and appears on one security blocklist, with 15 out of 95 security vendors on VirusTotal flagging it as malicious. No Google Safe Browsing (GSB) detections were recorded at the time of assessment, though this may reflect delayed reporting rather than benign status. The domain is currently offline, likely taken down following detection by the PhishDestroy blocklist. While this mitigates immediate user exposure, residual risk persists due to the domain’s recent creation date and the registrar’s history of hosting malicious infrastructure. Users who interacted with the site prior to takedown should assume potential credential compromise and monitor for unauthorized activity. Organizations should update internal blocklists to include this domain and its associated IP, while security teams are advised to investigate related infrastructure for lateral movement or secondary payload delivery. Proactive monitoring of newly registered domains under the same registrar is recommended to preempt similar threats.