appthorswap[.]app[.]apexfix[.]xyz

The domain appthorswap.app.apexfix.xyz is flagged as a crypto‑related impersonation campaign targeting the Across brand. Infrastructure analysis shows the domain was registered on 23 April 2025 through NiceNIC International Group Co., Limited and is serviced by the nameservers ns27.asurahosting.com and ns28.asurahosting.com. DNS resolution points to IP address 198.251.89.220, which belongs to AS53667 FranTech Solutions located in the United States. No TLS certificate is presented for the host, indicating that any HTTP connections would be unencrypted.

The page title returned from the site, "THORSwap", aligns with the reported scam type of a crypto‑draining operation, though the full page content has not been examined. VirusTotal scans record 15 detections out of 95 security vendors, evidencing a moderate level of vendor consensus on malicious behavior. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, reinforcing the assessment of hostile intent.

Current monitoring indicates the site is offline, but the underlying IP and hosting provider remain active and could be reused for future campaigns. Defenders should continue to block the domain and its associated IP at network perimeters, add the nameservers to watchlists for rapid detection of re‑registration, and maintain vigilance for any resurrected services that may reuse the same infrastructure. Continuous threat‑intel feeds should be consulted for updates on additional detections, and organizations using the Across brand should educate users about the lack of a legitimate THORSwap service to mitigate credential harvesting attempts.