switchboard[.]top

Analysis of the domain switchboard.top indicates it was actively involved in a wallet/seed phishing scheme impersonating the Across platform, as evidenced by its page title 'Switchboard Airdrop — Claim & $SWTCH Criteria' and classification under the 'Airdrop Scam' phishing kit. The domain was registered on September 9, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to IP address 172.67.149.180, hosted on Cloudflare's infrastructure (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (huxley.ns.cloudflare.com and sue.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. No SSL certificate was detected, increasing the likelihood of interception or manipulation of user data.

The domain was flagged by one of 95 security vendors on VirusTotal and appeared on a single security blocklist, suggesting limited but confirmed detection. It was subsequently taken offline and blocked by PhishDestroy. Defenders should treat this domain as a confirmed phishing threat targeting cryptocurrency users, particularly those expecting airdrops or token distributions. The absence of an SSL certificate and reliance on Cloudflare hosting are notable red flags, though not definitive on their own.

Organizations should monitor for similar domains registered through the same registrar or resolving to the same IP range, as these may indicate follow-up campaigns. Blocking the domain at the DNS level and alerting users to the specific 'Switchboard Airdrop' lure are recommended mitigations. The exact content of the phishing page remains unanalyzed, but the presence of airdrop-related terminology in the page title aligns with known tactics to exploit user interest in token giveaways.