frumentum[.]dev

The domain frumentum.dev is a phishing site engaged in brand impersonation targeting the 'across' platform. It poses an elevated risk by presenting itself as a legitimate blockchain service, specifically designed to deceive users into connecting wallets or participating in fraudulent airdrops. No crypto drainer kit was detected, but the site operated as an airdrop scam and wallet-connect phishing page. As of the latest verification, frumentum.dev has been taken offline.

Technical indicators confirm the malicious nature of frumentum.dev. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Google Safebrowsing and SOCRadar, though Google Safe Browsing itself did not flag it. It appears on 1 security blocklist (PhishDestroy) and was registered through NameCheap, Inc. on March 12, 2023. The site resolved to the IP address 206.206.78.203, hosted under AS215311 Regxa Company for Information Technology Ltd in Singapore, and used an SSL certificate issued by 'localhost'. The observed page title was 'Blockchain Node', and the domain employed HSTS technology. Trust scores from Gridinsoft and Scamadviser were 0/100 and 41/100, respectively.

Victims of frumentum.dev should take immediate action to secure their assets and accounts. For crypto-related scams, revoke any token approvals granted to the site and transfer funds to a new wallet. If login credentials were exposed, change passwords immediately, enable two-factor authentication, and monitor accounts for unauthorized activity. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand's security team to aid in takedown efforts and protect other users.