trevelyanbd[.]com

This domain, trevelyanbd.com, has been confirmed as a brand impersonation site specifically targeting Across, a decentralized finance protocol. The site employs deceptive tactics to mimic legitimate Across platform interfaces, likely aiming to harvest user credentials or manipulate transactions under false pretenses. The page title 'PCRF' suggests an attempt to impersonate internal or administrative components of the Across ecosystem, which could be used to lend credibility to fraudulent requests for sensitive information or unauthorized fund transfers. Analysis of the domain's infrastructure reveals multiple indicators of malicious intent. The domain was registered on September 10, 2023, through GoDaddy.com, LLC, and is flagged by 19 out of 95 security vendors on VirusTotal as malicious. It appears on one security blocklist and is explicitly blocked by PhishDestroy. The domain resolves to the IP address 172.67.132.53, hosted on Cloudflare's network (AS13335), a common tactic to obscure the true origin of phishing infrastructure. The SSL certificate, issued by Let's Encrypt, further masks the site's malicious nature by providing an appearance of legitimacy. Users who have interacted with trevelyanbd.com should take immediate action to mitigate potential risks. Any credentials or sensitive information entered on the site should be considered compromised and must be changed across all platforms where the same credentials were reused. Affected users should also review recent transactions for unauthorized activity, particularly within the Across protocol. Monitoring for signs of identity theft or further targeted phishing attempts is strongly advised. If financial assets were exposed, users should contact their wallet provider or financial institution to report potential fraud and explore recovery options.