checks-fomo[.]web[.]app

This domain, checks-fomo.web.app, is under investigation for brand impersonation targeting Across Protocol, a cross-chain bridging platform. The site presents itself as a legitimate portfolio tracker labeled 'FOMO - Portfolio Tracker,' likely designed to deceive users into entering sensitive credentials or wallet information under false pretenses. Such impersonation attempts are commonly used to harvest login details, private keys, or facilitate unauthorized transactions, posing a direct financial and security risk to visitors. Analysis indicates the domain is hosted on infrastructure associated with Google LLC, resolving to the IP address 199.36.158.100 within the Fastly, Inc. network (AS54113). Despite its active status and operational appearance, the domain has not triggered detections on VirusTotal (0/95 engines), suggesting either recent deployment or deliberate evasion techniques. However, it has been flagged by two independent security blocklists, including PhishDestroy and ScamSniffer, which corroborates suspicions of malicious intent. The SSL certificate, issued by Google Trust Services (WR4), provides encryption but does not validate legitimacy, as fraudulent sites frequently use valid certificates to appear trustworthy. Users who have visited checks-fomo.web.app or interacted with its content should take immediate action to mitigate potential risks. First, disconnect any connected wallets or sessions from the site and revoke any permissions granted via blockchain explorers or wallet interfaces. Monitor accounts for unauthorized transactions and consider transferring assets to a new wallet if credentials were entered. Report the domain to relevant security teams or threat intelligence platforms to aid in broader detection efforts. Exercise caution with unsolicited links, verify domain authenticity through official channels, and enable multi-factor authentication where available to reduce future exposure.