websea-login[.]at

This domain, www.websea-login.at, was identified as a fraudulent login portal impersonating the Across cross-chain bridge platform. The site presented a fake 'Websea Login Portal | Secure Websea Exchange Login Dashboard' interface designed to harvest user credentials, including wallet private keys or recovery phrases. Such attacks typically lead to unauthorized access and theft of digital assets, particularly targeting users of decentralized finance (DeFi) protocols and cross-chain services. Analysis indicates the domain was flagged by 3 out of 95 security vendors on VirusTotal, suggesting limited but confirmed detection. It was registered through Ddos-guard, a provider frequently associated with bulletproof hosting and malicious infrastructure. The domain appeared on one security blocklist and resolved to the IP address 45.10.243.7, which has been linked to other phishing campaigns in prior threat intelligence reports. No legitimate association with the Across protocol or its official services was found. Users who visited www.websea-login.at or entered credentials on the site should immediately revoke any active sessions, reset passwords, and transfer assets to a new wallet if private keys or seed phrases were exposed. Monitor accounts for unauthorized transactions and enable multi-factor authentication on all related services. Browser history and cached data should be cleared to remove any stored references to the malicious domain. Security teams are advised to block the domain and associated IP at the network level to prevent further exposure.