app[.]lyn-x[.]fi

Analysis of app.lyn-x.fi indicates this domain is a phishing site targeting cryptocurrency users, specifically mimicking a swap service as evidenced by the page title 'Swap | Lynex'. The domain was registered on February 21, 2026, and is currently offline as of the report date. Infrastructure analysis reveals it resolved to IP 23.254.229.249, hosted in the Netherlands under AS54290 (Hostwinds LLC). No SSL certificate was detected, increasing the likelihood of interception or tampering during data transmission.

Detection data shows limited but clear indicators of malicious activity: 4 out of 93 security vendors on VirusTotal flagged the domain, and it appears on two security blocklists (PhishDestroy and ScamSniffer). The absence of widespread detection does not confirm safety, as phishing domains often evade initial scans. Defenders should treat this domain as high-risk for crypto-related fraud, particularly given the page title's explicit reference to a swap service, which is a common vector for wallet-draining attacks. No brand-specific targeting beyond the 'Lynex' reference in the page title is confirmed, and the exact phishing kit or payload remains unanalyzed.

The domain's offline status may indicate takedown or temporary suspension, but defenders should assume it could resurface under the same or similar infrastructure. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for connections to 23.254.229.249, and alerting users to potential crypto swap scams associated with this domain. Further investigation into Hostwinds LLC-hosted domains may reveal related threats.