astarwallet[.]pages[.]dev

This domain, astarwallet.pages.dev, poses as a legitimate gateway for the Across protocol, a cross-chain bridging service. Analysis indicates it is designed to steal cryptocurrency wallet credentials and private keys, enabling attackers to drain funds from victim accounts. The site mimics the branding and interface of Across, using a deceptive login page titled 'Áster Network — Gateway & Login' to trick users into entering sensitive information. Given the high-risk nature of crypto-related credential theft, this infrastructure represents a direct financial threat to visitors. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on October 16, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Security vendors have flagged the domain, with 6 out of 95 engines on VirusTotal detecting it as malicious. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. Additionally, the domain appears on at least one security blocklist, further confirming its malicious intent. If you visited astarwallet.pages.dev or entered any credentials, immediate action is required. Disconnect the device from the internet to prevent potential data exfiltration. Reset passwords and private keys for all cryptocurrency wallets and accounts accessed from the compromised device. Monitor wallet transactions for unauthorized activity and consider revoking access to any connected decentralized applications (dApps). Users should also scan their devices for malware using updated security tools and report the incident to relevant platforms, such as Across’s official support channels, to help mitigate further risks.