Across Takes Front End and API Offline After Domain Takeover

Daniel Okafor

An attacker took control of across.to at about 1:45 p.m. ET (18:45 UTC), prompting Across to take its front end and application programming interface (API) offline, according to the protocol.

Across attributed the domain takeover to social engineering targeting Namecheap. The company said it suspended its own front end and API because of the phishing risk to visitors, then moved to block access to the compromised domain.

How quickly did Across respond?

Across received an alert within 15 minutes of the takeover and took action, the protocol said. SEAL911 flagged across.to as a phishing site. Cloudflare helped remove the domain’s DNS records, and Across said “the site is now fully offline and the phishing page cannot be accessed.”

Those steps separated containment of the phishing infrastructure from restoration of Across’s own services. The protocol’s front end and API remain paused until it resolves the security issue, so people cannot use those interfaces through across.to while the incident remains unresolved.

What do visitors face?

Across said visitors who reached across.to before Cloudflare removed the DNS records may have been affected. The announcement did not state how many people accessed the domain, what the phishing page displayed or requested, or whether any visitor submitted information. Those details remain unresolved in the protocol’s initial disclosure.

The same incident did not extend to third-party integrations or API users, according to Across. The company said those users had not been affected. That distinction matters operationally: the reported disruption covered Across’s own front end and API, rather than a broader failure across the services that connect to the protocol.

Why does Namecheap’s response matter?

Namecheap had not responded when Across issued the announcement. That left the protocol unable to confirm whether the domain was secure, even after the phishing page became inaccessible. Across said it “cannot confirm the domain is secure” while Namecheap has yet to respond.

Taking down the page and removing DNS records address the immediate access risk, but they do not resolve the protocol’s stated uncertainty over the domain. Across’s disclosure ties the continued pause to that unresolved security issue, leaving restoration dependent on resolution of the problem.

What happens next?

Across plans to investigate and publish a postmortem when it has more information. The announcement gave no date for that report and no timetable for bringing the front end and API back online. The immediate operational focus remains domain security, while third-party integrations and API users remain outside the reported impact.

Until Across resolves the domain-security issue, its direct web services stay offline, and the promised postmortem remains forthcoming.