cenactresolver[.]xyz

This domain, cenactresolver.xyz, is identified as a brand impersonation phishing site targeting Across Protocol, a cross-chain bridging platform. Analysis indicates the site was designed to deceive users into interacting with fraudulent smart contract interfaces or wallet drainers, likely aiming to siphon cryptocurrency assets under the guise of legitimate Across services. The page title, 'cenactresolver,' suggests a technical or resolution-themed pretext, potentially mimicking a bridge transaction or token swap interface to exploit user trust in the Across brand. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 10 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 1/100 and a Scamadviser score of 11/100. It was registered through Name.com, Inc. on November 18, 2025, and resolves to the IP address 216.198.79.1. The site employed Vercel hosting and enforced HTTP Strict Transport Security (HSTS), while its SSL certificate was issued by Let's Encrypt. It appears on one security blocklist and is currently blocked by PhishDestroy. The domain's creation date is anomalous, predating the current year, which may indicate an attempt to evade detection by appearing aged or legitimate. As of the latest assessment, cenactresolver.xyz has been taken offline, reducing immediate exposure risk. However, residual threats persist, including potential reuse of the infrastructure or migration of the phishing kit to a new domain. Users who interacted with the site prior to its takedown should revoke any connected wallet permissions, monitor for unauthorized transactions, and verify their devices for malware. Organizations should update blocklists to include this domain and its associated IP, while security teams should investigate related indicators for broader campaign linkages. The elevated risk classification reflects the domain's confirmed malicious intent and its targeting of high-value cryptocurrency users.