uscrgov[.]io

The domain uscrgov.io is a confirmed phishing site engaged in brand impersonation targeting the 'across' brand. It poses an elevated risk by presenting itself as a legitimate service to deceive users into disclosing sensitive information or credentials. No crypto drainer kit was identified, and the site is currently taken offline, reducing immediate exposure but not eliminating prior compromise risks.

Technical indicators show limited but clear malicious activity. As of analysis, 2 of 95 VirusTotal security vendors flagged uscrgov.io, including Gridinsoft, which assigned a trust score of 0/100. The domain appears on 1 security blocklist (PhishDestroy) and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on 2025-11-04. It resolves to IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), with nameservers may.ns.cloudflare.com and sevki.ns.cloudflare.com. No SSL certificate was observed, and the page title displayed was 'Web Landing Development Company'. Google Safe Browsing has not flagged the domain.

Users who interacted with uscrgov.io should take immediate safety steps. If credentials were entered, change passwords for the impersonated service and any reused accounts, then enable two-factor authentication. Monitor financial and account activity for unauthorized transactions or logins. Report the phishing domain to the impersonated brand’s security team, relevant authorities such as the FTC or local cybercrime units, and platforms like Google Safe Browsing or PhishTank to aid in broader mitigation efforts.