thorswap-explorer[.]pages[.]dev

This domain, thorswap-explorer.pages.dev, poses a brand impersonation threat targeting users of the Across cryptocurrency network. The site mimics the appearance of a legitimate network dashboard, potentially tricking visitors into disclosing sensitive information or authorizing malicious transactions. Such impersonation attempts often aim to harvest credentials or deploy crypto-draining scripts, putting digital assets at risk. Analysis indicates the domain was registered on February 21, 2026, through Cloudflare, Inc., a common registrar for both legitimate and malicious infrastructure. The site currently resolves to the IP address 172.66.47.155, hosted under AS13335 (Cloudflare, Inc.) in the United States. Security telemetry reveals the domain appears on one blocklist, while VirusTotal reports zero detections out of 95 engines, suggesting it may still be evading widespread detection. The SSL certificate is issued by Google Trust Services, adding a superficial layer of legitimacy. If a user has visited thorswap-explorer.pages.dev or interacted with its content, immediate action is required. Disconnect the device from the internet to prevent potential data exfiltration. Revoke any active wallet connections or authorizations granted to the site via blockchain explorers or wallet interfaces. Scan the device with updated security tools to detect any installed malware. Monitor connected accounts and wallets for unauthorized transactions, and consider migrating assets to a new wallet if compromise is suspected. Users should also report the domain to relevant security teams for further investigation.