momentum-sphere-ai[.]com

This domain, momentum-sphere-ai.com, is confirmed to engage in brand impersonation targeting Across, a decentralized finance platform. The site presents itself as an official portal for "Momentum Sphere Ai," using branding elements and page titles designed to deceive users into believing it is affiliated with Across. Analysis indicates the domain likely aims to harvest credentials, private keys, or other sensitive information under false pretenses, potentially leading to unauthorized access to user wallets or accounts. The inclusion of "UPDATED 2025" in the page title further suggests an attempt to appear legitimate and current, increasing the likelihood of successful deception. Technical evidence strongly supports the malicious classification of this domain. momentum-sphere-ai.com was registered on April 03, 2025, through MainReg INC., a registrar frequently associated with high-risk domains. It resolves to the IP address 91.236.116.69, hosted under AS42237 (w1n ltd) in Sweden, an autonomous system with a history of hosting fraudulent infrastructure. The domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating broad consensus among threat intelligence providers regarding its malicious nature. Additionally, it appears on one security blocklist and was proactively blocked by PhishDestroy. Notably, the domain lacks an SSL certificate, a red flag for any site handling sensitive user data, as it exposes communications to interception or tampering. Users who visited momentum-sphere-ai.com should take immediate remedial actions to mitigate potential risks. If any credentials, private keys, or personal information were entered on the site, these should be considered compromised and revoked or changed immediately across all platforms where they were reused. Affected users should also monitor their accounts for unauthorized transactions or suspicious activity, particularly those linked to decentralized finance or cryptocurrency services. It is recommended to conduct a full scan of any device used to access the domain using updated security tools to detect potential malware or backdoors. For enhanced protection, users should enable multi-factor authentication on all critical accounts and review recent login activity for anomalies. Given the domain's offline status, users should remain vigilant for similar impersonation attempts, as threat actors often re-establish operations under new domains.