swap-kinrix-fin[.]net

Analysis indicates that the domain swap-kinrix-fin.net was registered on 21 February 2026 through PublicDomainRegistry.com (operated by PDR Ltd.). The authoritative name servers are adele.ns.cloudflare.com and michael.ns.cloudflare.com, placing the domain within Cloudflare’s DNS infrastructure. DNS resolution points to IP address 104.21.61.133, which belongs to ASN 13335, owned by Cloudflare, Inc., and is geolocated in the United States. No TLS certificate is presented, meaning HTTPS connections would be unencrypted or would fail, a characteristic often observed in malicious infrastructure. The site is currently offline, but historical scans show a page title of “about:privatebrowsing”, which does not correspond to legitimate content and may be used to confuse users or evade detection. The domain has been classified as a crypto‑related scam that impersonates the brand “argent”.

This impersonation is reinforced by blocklist entries from PhishDestroy, MetaMask, and SEAL, and the domain appears on three additional security blocklists. VirusTotal analysis recorded 14 positive detections out of 93 scanned engines, indicating that multiple security vendors have identified malicious behavior. Gridinsoft assigned a trust score of 0 out of 100, further confirming a lack of legitimacy. Evidence suggests that the infrastructure relies on Cloudflare’s network, a common choice for threat actors seeking rapid deployment and DDoS mitigation. However, the absence of a valid SSL certificate and the offline status limit current visibility into the payload or phishing pages that may have been served.

The precise tactics, techniques, and procedures (TTPs) employed by the operators remain unknown because the live content was not captured before takedown. Defenders should add swap-kinrix-fin.net to internal blocklists and monitor DNS queries for the domain and its associated Cloudflare IP range. Network traffic to 104.21.61.