genfortunes[.]org

This domain, genfortunes.org, poses a high-risk brand impersonation threat targeting users of Across Protocol, a cross-chain bridging service. The site presents itself as a cryptocurrency options trading platform for Bitcoin, Ethereum, and altcoins, likely designed to deceive visitors into disclosing sensitive information, transferring funds, or installing malicious software. The content and structure closely resemble legitimate trading platforms, increasing the likelihood of successful social engineering attacks against users familiar with cryptocurrency services. Analysis indicates genfortunes.org was registered on November 20, 2021, through Gname.com Pte. Ltd., a registrar frequently associated with suspicious domains. The domain is flagged by 8 out of 95 security vendors on VirusTotal, with detections categorized under social engineering and brand impersonation. Additionally, it appears on three security blocklists and is currently blocked by PhishDestroy, ScamSniffer, and InversionDNS. Infrastructure analysis reveals the domain previously resolved to the IPv6 address 2a06:98c1:3120::3, a range commonly used for content delivery networks that may obscure the true origin of malicious activity. Users who visited genfortunes.org should immediately cease all interaction with the domain. If credentials, wallet addresses, or personal information were entered, affected parties should rotate passwords, revoke access to any linked cryptocurrency wallets, and monitor accounts for unauthorized transactions. Devices used to access the site should be scanned for malware, and any suspicious browser extensions or downloaded files should be removed. Given the domain's offline status, users should remain vigilant for similar impersonation attempts targeting Across Protocol or other cryptocurrency services.