peripheralautomation[.]org

This domain, peripheralautomation.org, was registered on November 6, 2024, through GoDaddy.com, LLC and is actively impersonating Across Protocol, a known cryptocurrency bridging service. As of July 12, 2026, the domain resolves to IP address 188.114.97.3, hosted on Cloudflare infrastructure (AS13335) in the United States. The site returns an HTTP 200 status with the page title 'Peripheral Automation,' though the exact content remains unanalyzed. Infrastructure analysis reveals the use of Cloudflare nameservers (alexa.ns.cloudflare.com and randall.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The domain appears on one security blocklist and has been referenced in 23 threat intelligence pulses on AlienVault OTX, indicating prior detection by the security community. One of 95 security vendors on VirusTotal flags the domain, though this does not constitute definitive evidence of malicious activity. The domain is classified as a crypto scam and is blocked by MetaMask, PhishDestroy, and SEAL. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and association with cryptocurrency fraud. Further investigation into its hosting infrastructure and associated campaigns is recommended, particularly given its use of Cloudflare to obfuscate backend servers. No evidence currently links this domain to additional payload delivery or multi-stage attacks, but monitoring for changes in resolution or SSL certificate updates is advised.