lynx-buyback[.]xyz

The domain lynx-buyback.xyz was registered on 21 February 2026 and is currently listed as offline. DNS resolution points to the IPv4 address 185.95.159.71, which belongs to AS209101 (Vendetta Inc.) and resolves to a hosting location in the Netherlands. The site presented a page titled “soluna vs SHARK – LynxHL Voting”, and its SSL certificate is identified as version R13. Intelligence indicates that the operation impersonates the Twitter brand and is classified as a crypto‑scam, consistent with the “Crypto Scam” label in the data set.

The domain appears on three independent security blocklists and has been actively blocked by the PhishDestroy, MetaMask, and SEAL filtering systems. VirusTotal analysis recorded five positive detections out of ninety‑three scanners, confirming that a subset of malware and phishing engines recognize the domain as malicious. The registration details, hosting ASN, and blocklist presence collectively suggest a purposeful campaign targeting cryptocurrency‑related transactions while leveraging the Twitter brand for credibility. However, the absence of a live HTTP response limits the ability to inspect the exact payload, user‑interaction flow, or any embedded malicious binaries.

Consequently, the full scope of the malicious content, including potential wallet‑drain techniques or credential‑harvesting forms, remains undetermined. Defensive teams should continue to enforce blocklist rules for lynx-buyback.xyz, monitor outbound connections to 185.95.159.71, and incorporate the domain into URL‑filtering policies. Additional sandboxing of any retrieved content, if the site reappears, would allow verification of the specific crypto‑draining mechanisms and support attribution efforts. Ongoing observation of related registrants and the AS209101 network is recommended to detect future iterations of the campaign.