chainflip-mainnet[.]xyz

On 21 February 2026 the domain chainflip-mainnet.xyz was registered through Cosmotown Inc. The domain resolves to the IPv4 address 78.46.40.242, which is hosted in Germany by Hetzner Online GmbH under autonomous system AS24940. The HTTP response currently returns an offline status, and the site’s SSL certificate is identified as type R12. The page title returned from the host is “Chainflip”, suggesting an attempt to associate the site with the Chainflip project, while the threat intelligence tags the domain as impersonating the brand “Across” and categorises the activity as a crypto‑scam.

VirusTotal analysis shows that twelve of ninety‑five scanning engines flagged the domain, indicating a moderate level of malicious detection. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. Reputation services assign extremely low trust scores: Scamadviser rates the site 1 out of 100, and Gridinsoft rates it 0 out of 100. No additional threat‑intel feeds such as OTX or Safe Browsing are referenced in the supplied data.

The available evidence points to an infrastructure set up for fraudulent cryptocurrency‑related activity, leveraging a reputable hosting provider to obscure attribution. Defenders should add the IP address 78.46.40.242 to deny‑list rules, monitor for any future DNS resolution changes, and enforce blocklists that include chainflip‑mainnet.xyz. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution of the payload. Until further forensic analysis of the site content is possible, the domain should be treated as a high‑risk crypto impersonation vector.