thorswap-xplorer[.]pages[.]dev

This domain is flagged as an active high-risk brand impersonation threat specifically targeting Across bridge users through a fraudulent blockchain transaction explorer interface. The page, titled Thorswap Explorer — Blockchain Transaction Explorer, mimics legitimate cryptocurrency infrastructure to deceive users into disclosing wallet credentials or approving malicious transactions under the guise of Across protocol functionality. Analysis indicates the domain thorswap-xplorer.pages.dev was registered on August 26, 2025, through Cloudflare, Inc. Infrastructure analysis reveals the domain resolves to IPv6 address 2606:4700:310c::ac42:2f61, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. Detection metrics show the domain appears on one security blocklist, with VirusTotal reporting 1/95 security vendors flagging the domain as malicious. The single vendor detection suggests either early-stage deployment or evasion techniques targeting less common detection systems. Mitigation against this brand impersonation threat requires multi-layered verification procedures. Users should cross-reference all blockchain explorer domains against official protocol documentation, particularly when interacting with cross-chain bridge interfaces. Wallet software should be configured to display full domain verification warnings before transaction signing. Network-level protections should incorporate the identified IPv6 address and domain into blocklists, while monitoring for additional domains using similar naming patterns (thorswap-xplorer, across-explorer variants). Incident responders should examine transaction patterns from the identified infrastructure for potential unauthorized fund movements or approval phishing attempts targeting Across protocol users.