vertoai[.]net

Analysis of vertoai.net indicates an active brand impersonation campaign targeting the Across protocol, a cross-chain bridging platform. The domain was registered on April 30, 2025, through Squarespace Domains LLC and currently resolves to IP address 34.111.179.208, hosted on Google Cloud infrastructure with HTTP/3 and HSTS enabled. The page title, 'VERTO — Launch your stablecoin in 90 days,' directly references stablecoin deployment, a service associated with Across, though no confirmed connection to the legitimate Across brand has been established beyond the impersonation classification. Security vendors have flagged the domain on multiple blocklists, including ScamSniffer, PhishDestroy, and BLP-Malware, with three distinct security feeds listing it as malicious. Gridinsoft assigns a trust score of 0/100, while AlienVault OTX records 23 threat intelligence pulses referencing this infrastructure. Three of ninety-five security vendors on VirusTotal detect the domain as malicious, though the absence of detections from other vendors does not confirm safety. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. Defenders should treat this domain as high-risk infrastructure due to its confirmed brand impersonation status, active blocklist presence, and association with known phishing indicators. Network-level blocking is recommended, particularly for organizations exposed to cross-chain or DeFi-related threats. Further analysis of the site's content and backend behavior is required to determine the exact mechanics of the fraud, including whether it employs credential harvesting, fake token deployments, or other social engineering tactics. No evidence currently suggests this domain is part of a broader phishing kit or campaign, but its alignment with Across's service offerings warrants heightened scrutiny.