blaze-panel[.]org

This domain, blaze-panel.org, is identified as a high-risk brand impersonation resource targeting users of Across Protocol, a liquid staking platform. Analysis indicates the site presented itself as a legitimate Across liquid staking interface, using the page title 'Blaze - Liquid Staking' to deceive visitors into interacting with malicious infrastructure. No direct evidence of a drainer kit was observed, though the domain's structure and content align with known tactics for credential harvesting and token theft in decentralized finance contexts. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated creation that may indicate registry manipulation or data entry error. The domain resolved to IP address 104.21.78.11, hosted on AS13335 Cloudflare, Inc., a common obfuscation technique leveraging content delivery networks. At the time of assessment, 12 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared on three independent security blocklists. No SSL certificate was present, increasing the likelihood of interception or tampering during data transmission. Google Safe Browsing did not list the domain at the time of analysis, though this does not preclude prior or subsequent detection. The domain has since been taken offline, likely in response to security community reporting or registrar enforcement actions. Despite its current inactive status, residual risk remains due to potential reuse of associated infrastructure or re-registration under similar naming conventions. Users who interacted with the domain prior to takedown are advised to revoke any connected smart contract approvals, rotate credentials, and monitor accounts for unauthorized transactions. Organizations operating in the liquid staking sector should update detection rules to include this domain and its associated indicators of compromise.