thirdwebv[.]shop

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the Across protocol, a cross-chain bridging service. Analysis indicates the site employs social engineering tactics to trick victims into connecting cryptocurrency wallets or entering sensitive credentials, likely facilitating unauthorized asset transfers or account takeovers. The page title 'Access Restricted' suggests an attempt to create urgency or mimic legitimate access controls, a common tactic in crypto-focused phishing schemes. Infrastructure analysis reveals the domain thirdwebv.shop was registered on November 11, 2025, through Kenpai International Technology Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 18.167.49.182, which has been linked to prior phishing campaigns. Detection metrics indicate broad consensus among security vendors, with 15 out of 95 engines on VirusTotal flagging the domain as malicious. The domain appears on four security blocklists, including MetaMask, SEAL, PhishDestroy, and InversionDNS, and is explicitly labeled as 'SOCIAL_ENGINEERING' by Google Safe Browsing. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. The domain is currently offline, though historical activity and registration patterns suggest potential for re-emergence under similar infrastructure. Mitigation measures should prioritize user awareness and technical controls to prevent exposure to this threat. Organizations and individuals utilizing the Across protocol or similar crypto services should implement strict domain verification processes, ensuring users only interact with officially verified endpoints. Wallet providers and browser extensions should enforce blocklists to prevent access to known malicious domains, including this one. Users should be educated to recognize social engineering tactics, such as fake access restrictions or urgent prompts to connect wallets. Additionally, monitoring for newly registered domains with similar naming patterns or registrars can help preemptively identify related threats. If exposure is suspected, immediate revocation of wallet permissions and account credentials is recommended to mitigate potential asset loss.