nyancoin[.]io

nyancoin.io was registered on 19 August 2025 through NameCheap, Inc. The domain resolves to 172.67.191.30, an IP owned by AS13335 Cloudflare, Inc., and uses Cloudflare’s authoritative nameservers adrian.ns.cloudflare.com and norm.ns.cloudflare.com. TLS termination is provided by Google Trust Services under the WE1 certificate, and the site returns HTTP 200 for the root URL. The page title observed is “🌈 Nyan on Bags – The Meme Legend Reborn on Web3”, and the domain is listed as impersonating the brand “across” in a crypto‑scam campaign. Threat intelligence sources have placed the domain on one security blocklist and it has been blocked by PhishDestroy. VirusTotal analysis shows a single positive detection out of 95 scanning engines, and Gridinsoft assigns a trust score of 0 / 100, indicating a high likelihood of malicious intent. The infrastructure remains active as of the report date (12 July 2026). No additional content inspection has been performed, so the exact phishing flow, credential‑capture mechanisms, or cryptocurrency address usage are not yet confirmed. Defenders should prioritize the domain for blocking at network and DNS layers, monitor for any related C2 traffic to the associated Cloudflare IP, and incorporate the observed indicators (domain name, IP address, nameserver pair, TLS certificate fingerprint) into threat‑intel feeds. Continuous scanning of the site and rapid response to any emerging payloads are recommended.