cross-pay.vercel.app: Confirmed Across Protocol Impersonation

Analysis of the domain cross-pay.vercel.app indicates confirmed brand impersonation targeting Across Protocol, a known cross-chain bridge service. The domain was registered on March 13, 2026, through Vercel Inc. and remains active as of July 12, 2026. Infrastructure analysis reveals it resolves to IP address 64.29.17.131 and is hosted on Vercel's platform, with HSTS enabled. The domain appears on three security blocklists and is explicitly blocked by SEAL, MetaMask, and PhishDestroy, confirming its malicious classification. VirusTotal detection data shows 9 of 95 security vendors flagging the domain as malicious, though this represents a minority of engines and should not be interpreted as definitive proof of compromise. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy given the prevalence of free, automated certificate issuance. Gridinsoft assigns a trust score of 0/100, further supporting its classification as high-risk. No specific phishing kit or exact page content has been analyzed, so the precise mechanics of the scam remain unconfirmed. However, the combination of brand impersonation, recent registration, and active blocking by multiple security vendors strongly suggests credential harvesting or fraudulent transaction activity. Defenders should treat this domain as malicious and implement blocking measures at the DNS or network level. Given its continued activity, monitoring for related infrastructure (e.g., subdomains, linked IPs) is recommended.