claim-forestprotocol[.]xyz

The domain claim-forestprotocol.xyz was registered on February 21, 2026 through OwnRegistrar, Inc. and is currently listed as offline. Infrastructure analysis shows the domain resolves to IP address 104.21.64.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title "Forest Protocol | Launch Playable Tokens Instantly," but no further content has been captured. SSL certificate details are identified only as "WE1," and the Gridinsoft trust score for the domain is 0 / 100, indicating a lack of trustworthiness.

The domain appears on five independent security blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, confirming that multiple threat‑intelligence feeds have flagged it. VirusTotal analysis reports three of ninety‑three scanning engines flagging the domain, reinforcing the suspicion of malicious activity. The classified scam type is "Wallet/Seed Phishing," and the threat actor is noted to impersonate the brand "Across," suggesting that any credential or seed phrase collection attempts would target users of that service. Evidence from the known intelligence does not include safe‑browsing or OTX entries, and no additional URL paths or payload samples have been disclosed.

Uncertainty remains regarding the exact phishing page content and whether the domain may be re‑activated in the future. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP range for any re‑use, and enforce user awareness campaigns that reference the specific impersonated brand. Ongoing telemetry collection from the listed blocklists and periodic re‑scans with VirusTotal are recommended to capture any changes in the domain’s status or detection profile.