thxy[.]ink

The domain thxy.ink was registered on October 18, 2025 through Domain International Services Limited and is currently offline. DNS resolution points to the Cloudflare address 172.64.152.241, which belongs to AS13335 in the United States. The site presented the page title “Download Base - Your home for everything onchain,” a phrasing that aligns with the listed scam type of a crypto scam and the impersonation of the brand “across.” No TLS certificate was observed, indicating that the site was served over plain HTTP.

Reputation checks show a Gridinsoft trust score of zero out of one hundred, and the domain appears on a single security blocklist. VirusTotal analysis recorded six detections out of ninety‑five scanners, confirming malicious activity, while AlienVault OTX references the domain in one threat‑intel pulse. The nameserver set includes ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, and ns4.domainname, suggesting a custom DNS configuration often used by threat actors.

Blocking services such as PhishDestroy have already taken the domain down, but the lack of SSL and the low trust score indicate a high probability of credential or cryptocurrency theft. Defenders should continue to block the domain at network perimeters, monitor for related IP activity from the Cloudflare edge, and update endpoint detection rules to flag any attempts to connect to thxy.ink or resolve its associated nameservers. Further investigation is needed to determine whether additional infrastructure shares the same registrar or naming pattern, which could reveal a broader campaign targeting users of the across brand.