truterabk[.]com

This domain, truterabk.com, is flagged as a confirmed phishing infrastructure specializing in brand impersonation targeting Across, a recognized entity in the decentralized finance and cross-chain bridging sector. Analysis indicates the site was designed to mimic legitimate Across platform interfaces, likely to harvest user credentials, private keys, or facilitate unauthorized fund transfers. The page title, 'Truterabk,' suggests an attempt to create a plausible facade, while the use of technologies such as PHP, Bootstrap, and LiteSpeed server indicates a structured, server-side phishing operation rather than a static lure. Infrastructure analysis reveals truterabk.com was registered through Cosmotown, Inc. on June 12, 2025, and resolves to the IP address 192.3.190.186. The domain is currently detected by 3 out of 95 security vendors on VirusTotal, indicating limited but active detection coverage. It appears on one security blocklist and has been assigned a Gridinsoft trust score of 0/100, reflecting high confidence in its malicious nature. Additional technologies identified include Smartsupp (likely for live interaction or data exfiltration), OWL Carousel (for dynamic content presentation), jQuery, and HTTP/3 support, which may enhance the site’s responsiveness and evasion capabilities. As of the latest assessment, truterabk.com has been taken offline, reducing immediate exposure risk. However, the infrastructure components—such as the IP address, registrar, and associated technologies—remain viable for potential reuse in future campaigns. Users who interacted with the domain prior to takedown may still be at risk of credential compromise or follow-on attacks. It is recommended that organizations monitor for connections to 192.3.190.186, review logs for access to truterabk.com, and implement domain-based blocking at the network perimeter. Continued vigilance is advised, as threat actors frequently repurpose registrar accounts and hosting resources for subsequent malicious operations.