reg-gtprotocolio[.]pages[.]dev

This domain operates as a brand impersonation threat targeting users of the Across protocol by presenting itself as an official GT Protocol platform. The site is designed to deceive visitors into believing they are interacting with a legitimate cryptocurrency service, potentially leading to credential theft, unauthorized transactions, or the installation of malicious software. The use of a similar naming convention (GT Protocol) and branding elements closely resembling Across increases the likelihood of successful social engineering attacks against users familiar with the targeted protocol.

Analysis indicates the domain was registered on January 25, 2024, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335). VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. The SSL certificate is issued by Google Trust Services, and the domain remains actively accessible. Additional technical indicators include detection by PhishDestroy, ScamSniffer, and Enkrypt, further confirming its malicious intent.

Users who have visited reg-gtprotocolio.pages.dev should immediately cease all interaction with the site. Those who entered credentials or connected wallets should assume compromise and take the following steps: revoke any active wallet connections to the domain, transfer assets to a new wallet, and monitor accounts for unauthorized transactions. System scans using updated security tools are recommended to detect potential malware. Organizations should add the domain and associated IP address to internal blocklists to prevent further exposure.