ritualpresale[.]xyz

Analysis of the domain ritualpresale.xyz indicates a confirmed crypto scam operation impersonating the Across protocol, a decentralized bridging platform. The domain was registered on October 19, 2025, through Ultahost, Inc., and currently resolves to the IP address 45.12.2.67, hosted under AS6698 (Virtual Systems LLC) in Ukraine. Infrastructure analysis reveals the use of custom nameservers (ns1.ritualpresale.xyz and ns2.ritualpresale.xyz) and an active Let's Encrypt SSL certificate (R13), suggesting an attempt to appear legitimate. The page title, 'Ritual - The World's Sovereign Chain for AI,' does not align with the impersonated brand (Across), indicating a possible attempt to mislead users by leveraging unrelated terminology. Security vendor detections on VirusTotal report 5 of 95 engines flagging the domain as malicious, while the domain appears on at least one security blocklist (PhishDestroy). The Gridinsoft trust score of 0/100 further supports its classification as high-risk. MX records configured for mail.ritualpresale.xyz suggest potential use for phishing emails or further social engineering attempts. The domain remains active as of July 12, 2026, returning an HTTP 200 status, confirming its operational status. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related activities occur. Monitoring for related infrastructure, such as subdomains or associated email activity, is recommended. Given the domain's registration age and active status, continued vigilance is warranted to mitigate potential financial fraud targeting users of the Across protocol.