serverportal[.]live

The domain serverportal.live is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Across brand. It was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The domain uses Cloudflare nameservers aria.ns.cloudflare.com and curt.ns.cloudflare.com, and serves an HTTPS certificate issued by Google Trust Services under the WE1 trust chain. HTTP responses indicate a permanent redirect (301) and the site advertises HSTS, Cloudflare Browser Insights, Cloudflare services, and HTTP/3. The page title observed is "Dapp Network - The Server Portal Ecosystem," and the campaign is associated with the seed_phish and wallet_connect_phish scam vectors. Independent blocklists have listed the domain on four separate blocklists, and it is blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis shows nine of ninety‑three security vendors flag the domain as malicious. While the exact phishing page content has not been publicly disclosed, the combination of brand impersonation, credential‑stealing kit identifiers, and multiple blocklist listings suggests a coordinated effort to harvest wallet credentials. Defenders should add serverportal.live to deny‑list rules, monitor DNS queries for the associated IP and nameservers, and enforce strict validation of wallet connection prompts. Continuous observation of any changes to the SSL certificate, HTTP status, or additional blocklist entries is recommended to adjust mitigation measures promptly.