brervis[.]network

Analysis of the domain brervis[.]network indicates it was actively used for wallet and seed-phrase phishing targeting users of the Across protocol. The domain, created on February 21, 2026, was registered through NiceNIC International Group Co., Limited and hosted behind Cloudflare IP 188.114.97.3 (AS13335, United States). At the time of assessment on July 24, 2026, the site was offline, returning no active HTTP response. Security vendors detected malicious activity on this domain: six of the 93 engines on VirusTotal flagged it as harmful.

It appeared on five independent blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. Gridinsoft assigned a trust score of 0 out of 100, reflecting high confidence in its malicious classification. The page title, 'Brevis Network', does not match the known branding of Across, though the domain was explicitly linked to Across impersonation in threat intelligence sources. No SSL certificate was present, increasing the likelihood of interception or tampering.

Nameservers were Cloudflare-hosted (major.ns.cloudflare.com and teagan.ns.cloudflare.com), a common pattern in phishing infrastructure due to the provider's privacy and proxy services. While the domain is currently offline, defenders should treat any future resolution or re-registration as suspicious. Network security teams are advised to block the domain and IP at perimeter level, and wallet providers should flag any interaction with brervis[.]network as high-risk. End users should be warned that any prior interaction with this domain may have exposed wallet credentials or recovery phrases.