renbridge-site[.]github[.]io

This domain, renbridge-site.github.io, is actively engaged in brand impersonation targeting the cryptocurrency bridging platform 'across.' Analysis indicates the site mimics legitimate branding to deceive users into disclosing sensitive credentials, wallet access, or executing unauthorized transactions. The threat is classified as high-risk due to its active status and direct targeting of financial infrastructure users. Infrastructure analysis reveals concrete indicators of malicious activity. The domain is flagged by 5 out of 95 security vendors on VirusTotal, with additional detections on two independent security blocklists. It is registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious domains. The page title, 'RenBridge,' further aligns with known impersonation tactics, and the domain is actively blocked by fraud detection systems. Users who have interacted with renbridge-site.github.io should take immediate action to mitigate potential risks. Disconnect any connected wallets or accounts, revoke permissions granted to the site, and monitor for unauthorized transactions. If credentials were entered, reset passwords and enable multi-factor authentication on all related accounts. Security teams should update blocklists to include this domain and its associated IP address, while users should report the site to relevant abuse channels for further investigation.