wrectify[.]xyz

This domain, wrectify.xyz, is assessed as a confirmed phishing site targeting users of the Across protocol through a fraudulent airdrop scheme. Registered on February 21, 2026, the domain was operational until recently taken offline. Infrastructure analysis reveals hosting on Cloudflare IP 172.67.178.88 (AS13335, United States), a common pattern for phishing campaigns leveraging Cloudflare's proxy services to obscure origin servers. The SSL certificate (WE1) provides no additional trust indicators, consistent with low-effort malicious domains.

The page title 'Wallet Rectify' and scam classification as a 'Fake Airdrop' align with known tactics to deceive cryptocurrency users into connecting wallets to malicious smart contracts. Detection data shows the domain was flagged by four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and was identified by 5 of 93 security vendors on VirusTotal prior to takedown. No Safe Browsing or Open Threat Exchange (OTX) data is currently available for this domain. Defenders should treat this domain as high-risk for Across protocol users.

Recommended actions include blocking the domain and IP at perimeter security controls, monitoring for related domains using similar naming conventions (e.g., 'rectify', 'wallet', or 'across' variations), and alerting users who may have interacted with the site prior to takedown. The use of Cloudflare hosting suggests potential for rapid redeployment; defenders should prioritize monitoring for new domains resolving to the same IP or ASN. No evidence of a phishing kit or additional infrastructure links has been confirmed at this time.