usualmoneylabs[.]com

Analysis of usualmoneylabs.com indicates active brand impersonation targeting the Across protocol, a decentralized finance platform. The domain was registered on February 21, 2026, through Dynadot LLC and remains operational as of July 12, 2026. It resolves to IP address 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States. The page title explicitly displays 'Usual Protocol,' a direct reference to the legitimate Across brand, reinforcing the likelihood of fraudulent intent. Infrastructure review reveals the domain employs Cloudflare nameservers (coco.ns.cloudflare.com and vern.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The site returns an HTTP 200 status, confirming active hosting, and utilizes Google Web Server with HSTS and HTTP/3 protocols. Detection metrics show the domain is flagged by 3 of 95 security vendors on VirusTotal and appears on one security blocklist, including PhishDestroy. A Gridinsoft trust score of 0/100 further supports the classification of this domain as malicious. The primary uncertainty lies in the exact payload or deception mechanism employed, as no specific malware samples or phishing kit signatures have been publicly attributed to this domain. However, the combination of brand impersonation, recent registration, and low detection coverage suggests a targeted campaign designed to evade initial scrutiny. Defenders should prioritize blocking the domain and its resolving IP at the network level, while monitoring for related subdomains or redirect chains. Users encountering this domain should be advised to verify the legitimacy of any Across-related communications through official channels only.