compound[.]icu

This domain, compound.icu, was identified as a brand impersonation phishing site targeting users of the Across platform. The site presented itself as the legitimate Across interface, likely aiming to deceive visitors into disclosing sensitive credentials or interacting with malicious smart contracts. Such impersonation attacks are commonly used to facilitate unauthorized access to cryptocurrency wallets or other financial assets by exploiting user trust in familiar branding. Analysis indicates the domain was registered on February 21, 2026, through the WE1 registrar, an entity frequently associated with short-lived malicious domains. Infrastructure analysis reveals the site resolved to the IP address 172.67.132.215, hosted on Cloudflare’s network (AS13335). Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, with one additional security blocklist listing it. The use of Cloudflare hosting is a common tactic to obscure the true origin of phishing infrastructure while providing SSL encryption to appear legitimate. Users who visited compound.icu or interacted with its content should take immediate action to mitigate potential risks. First, revoke any wallet or smart contract permissions granted to unknown or suspicious addresses. Second, scan the device used for access with updated security tools to detect any installed malware. Finally, monitor accounts associated with the Across platform for unauthorized transactions and enable multi-factor authentication where available. If credentials were entered, reset them immediately and avoid reusing passwords across services.