vertomessenger[.]us

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users of the Across protocol. Analysis indicates the site mimics the Verto Messenger decentralized application interface, likely to harvest credentials, private keys, or other sensitive authentication details from cryptocurrency users. The impersonation targets individuals familiar with Across, a cross-chain bridging platform, by presenting a fraudulent frontend that closely resembles legitimate decentralized communication tools. Infrastructure analysis reveals the domain vertomessenger.us was registered on January 8, 2024, through NameCheap, Inc. It resolves to the IP address 80.82.67.215, a host with a documented history of malicious activity. Detection metrics show the domain is flagged by 2 out of 95 security vendors on VirusTotal, while Gridinsoft assigns it a trust score of 0 out of 100. The domain appears on one security blocklist and was actively blocked by at least one threat intelligence feed prior to being taken offline. The page title, 'Verto Messenger Decentralized App,' further confirms the intent to impersonate legitimate decentralized messaging services. Mitigation steps for this threat type include immediate domain blacklisting in enterprise and consumer security tools, particularly those monitoring cryptocurrency-related traffic. Users who interacted with the site should revoke any permissions granted to decentralized applications and rotate credentials or private keys associated with Across or related services. Organizations should monitor network traffic for connections to 80.82.67.215 and domains registered through NameCheap during the same timeframe, as these may indicate related malicious infrastructure. Security teams are advised to update detection rules to include the domain, IP, and associated indicators of compromise to prevent future exposure.