313b2f9e[.]wormhole-5sz[.]pages[.]dev

The domain 313b2f9e.wormhole-5sz.pages.dev is a phishing site engaged in brand impersonation targeting the 'across' platform. It poses an elevated risk by mimicking the legitimate brand to deceive users into disclosing sensitive information or interacting with fraudulent services. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate exposure but not eliminating prior compromise risks.

Technical indicators confirm the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 188.114.97.3, hosted on Cloudflare's US infrastructure (AS13335). Detection remains limited, with only 1 of 95 VirusTotal security vendors flagging it, and a single security blocklist (PhishDestroy) listing the domain. Google Safe Browsing has not flagged it. The SSL certificate is issued by Google Trust Services (WE1), and observed technologies include HSTS, Cloudflare, and HTTP/3. The page title displayed 'Wormhole', and the domain appeared on 1 security blocklist at the time of assessment.

Users who interacted with 313b2f9e.wormhole-5sz.pages.dev should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on associated accounts, and monitor for unauthorized transactions or identity fraud. If financial or crypto assets were exposed, revoke any token approvals and transfer funds to a new, secure wallet. Report the phishing domain to the impersonated brand's security team (Across Protocol) and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid broader protection efforts.