blockchandex[.]com

The domain blockchandex.com has been identified as a high-risk brand impersonation threat specifically targeting Across, a decentralized bridging protocol. Analysis confirms this domain was designed to deceive users into interacting with fraudulent wallet rectification or synchronization interfaces under the guise of legitimate Across infrastructure. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered on July 23, 2025, through Tucows Domains Inc. and resolved to the IP address 172.67.172.1. Security telemetry indicates the domain was flagged by 14 of 95 vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100. The domain appeared on four distinct security blocklists, including entries from Polkadot, Codeesura, PhishDestroy, and Enkrypt. The page title, "Node Server Switch Wallet Rectifier - Rectification, Synchronization, and Validation," suggests an attempt to mimic technical validation processes associated with blockchain node operations, a common tactic in crypto drainer or wallet compromise schemes. Current status confirms blockchandex.com is offline, though residual risk persists for users who may have interacted with the domain during its active period. Organizations and individuals are advised to review transaction histories for any unauthorized activity linked to this domain, particularly those involving Across protocol interactions. Network-level blocking of the IP 172.67.172.1 and domain-based filtering for "blockchandex.com" is recommended as a preventive measure. Users should verify all bridging or wallet rectification requests through official Across channels and report any suspicious domains to relevant threat intelligence platforms for further analysis.