finyxa[.]com

finyxa.com is an active brand‑impersonation site targeting users of the Across Protocol ecosystem. The page title “Finyxa | Save, spend, send and invest money across borders” mimics legitimate financial services and attempts to lure victims into cryptocurrency transactions. The domain was registered on February 21 2026 through DropCatch.com 507 LLC and has been operating for only a few months, yet it already carries a high‑risk rating. The site resolves to the IPv4 address 198.12.66.123, which belongs to AS36352 hosted by HostPapa in the United States. DNS resolution is provided by ns1.afternic.com and ns2.afternic.com, both standard Afternic name servers. An SSL certificate identified as “R10” is presented, and the HTTP response returns status 200, indicating a fully functional web server. No additional infrastructure such as CDN or reverse‑proxy services is observed. Reputation data shows the domain appears on a single security blocklist and is blocked by PhishDestroy. VirusTotal scans have flagged the site by one of ninety‑five vendors, and the Gridinsoft trust score is 0 out of 100, reinforcing the malicious classification. The limited number of detections suggests the site may be newly deployed or using low‑profile hosting to evade broader detection. Defenders should add 198.12.66.123 to network block lists and monitor DNS queries for finyxa.com and its Afternic name servers. Email and web filtering rules should be updated to flag the exact page title and any content referencing “save, spend, send and invest money across borders.” Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture additional detections as the site gains visibility. Incident response teams should advise users of Across Protocol to verify URLs and avoid unsolicited cryptocurrency requests linked to this domain.