rewards-phiprotocol[.]xyz

The domain rewards-phiprotocol.xyz is identified as a brand impersonation threat specifically targeting the 'across' platform. The site’s use of the page title 'Phi Protocol' and its similarity to legitimate protocol branding increase the risk of users being deceived into interacting with fraudulent services, potentially exposing them to crypto drainer attacks or credential theft targeting digital assets.

Analysis confirms that rewards-phiprotocol.xyz was created on September 01, 2025, and registered via OwnRegistrar, Inc. The domain resolves to IP address 104.21.36.104 and was found listed on two distinct security blocklists. VirusTotal analysis shows that 4 out of 95 security vendors have flagged this domain as malicious. Additional risk indicators include a Gridinsoft trust score of 0/100 and blocking by known threat intelligence sources. The domain is currently offline, indicating a takedown or removal action following detection.

Users who visited or interacted with rewards-phiprotocol.xyz should immediately run a comprehensive malware and credential scan on their devices. It is critical to review and reset credentials associated with digital wallets, especially those linked to across or similar platforms. Any detected unauthorized transactions or wallet connections should be reported to the appropriate support channels. Users are advised to monitor crypto wallet activity and avoid engaging with domains exhibiting similar naming or branding patterns. All suspicious communications referencing 'Phi Protocol' or rewards-related offers should be treated with heightened caution.