noarisprotocol[.]com

The domain noarisprotocol.com has been identified as a brand impersonation threat specifically targeting Across Protocol. Analysis confirms this domain was designed to deceive users by mimicking the legitimate infrastructure of Across Protocol, a known decentralized bridging platform. The domain is currently offline, but prior activity indicates malicious intent to exploit brand recognition for fraudulent purposes. Infrastructure analysis reveals the domain was registered on July 30, 2025, through MAT BAO CORPORATION. It resolved to the IP address 172.67.178.8, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain appeared on one security blocklist and was flagged by 9 of 95 security vendors on VirusTotal. The SSL certificate was issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious domains leveraging Cloudflare services. The combination of brand impersonation, recent registration, and detection by multiple security engines underscores the elevated risk associated with this domain. As of the latest verification, noarisprotocol.com has been taken offline, likely due to enforcement actions or infrastructure changes. However, organizations and users are advised to treat any prior interactions with this domain as compromised. Security teams should block the domain and its associated IP (172.67.178.8) at the network perimeter, monitor for residual connections, and alert users who may have engaged with the domain before its takedown. Additionally, reviewing logs for traffic to the domain or its IP can help identify potential exposure or ongoing threats.