b--nqi[.]fi

Analysis of b--nqi.fi shows a recent domain created on March 11, 2026 and registered through Immaterialism Ltd. The site’s page title resolves to "Benqi," which aligns with the reported brand‑impersonation pattern targeting the across brand. Infrastructure inspection reveals the domain is served by Cloudflare, using the nameservers porter.ns.cloudflare.com and savanna.ns.cloudflare.com, and resolves to the IP address 104.21.4.69 located in the United States under ASN 13335 (Cloudflare, Inc.). The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint at the time of capture. Security telemetry indicates the domain has been flagged by two of ninety‑four vendors on VirusTotal and appears on three external blocklists.

Additionally, AlienVault OTX references the domain in two threat‑intel pulses, and Gridinsoft assigns a trust score of zero out of one hundred, underscoring a high risk profile. Defensive products such as PhishDestroy, MetaMask, and SEAL have already listed the domain as malicious, confirming active mitigation in the ecosystem. The current operational status is offline, which may be a temporary takedown or a pre‑emptive removal by the operator.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration or resurrection attempts, and correlate any observed traffic to the associated IP 104.21.4.69 with existing Cloudflare‑based threat feeds. Given the wallet/seed phishing classification, any credential or seed capture attempts linked to this host should be treated as compromised. Ongoing vigilance is advised, especially for users interacting with across‑related services, to prevent credential harvesting or unauthorized wallet access.