thenafl[.]org

The domain thenafl.org was registered on February 21 2026 via NameSilo, LLC. It resolves to IP 188.114.96.3, which is owned by Cloudflare (ASN 13335) and geolocated to the United States. The site presents the page title “Dashboard | THENA” and serves an SSL certificate labeled WE1. Public detection services have identified the domain as malicious: eight of ninety‑three VirusTotal scanners flagged it, and it is listed on two external blocklists, including PhishDestroy and ScamSniffer. The Gridinsoft trust score is 0 out of 100, indicating a high confidence of malicious intent.

Intelligence attributes the activity to a wallet/seed phishing campaign that impersonates the brand “across”. The current operational status is offline, suggesting the site has been taken down or is no longer serving content. The combination of a low trust score, multiple vendor detections, and inclusion on phishing‑specific blocklists indicates a credible threat. Defenders should block traffic to 188.114.96.3 and add thenafl.org to local deny lists.

Monitoring of Cloudflare‑hosted IP ranges for similar activity is advised, as is periodic re‑query of VirusTotal and other sandbox services for any re‑appearance. Because the page content beyond the title has not been publicly captured, further analysis of the landing page is pending. Organizations should alert users to the possibility of wallet or seed credential harvesting attempts that reference the “across” brand and enforce MFA on wallet services.