b[.]kryllion[.]io

This domain, b.kryllion.io, was registered on February 21, 2026 and is currently listed as offline. The site presents a page title that reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Exchange”, directly referencing the Ethereum brand, which aligns with the reported brand‑impersonation intent. Infrastructure analysis shows the domain resolves to the IP address 172.67.153.54, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The hosting provider is therefore a widely used content‑delivery network, a common choice for threat actors seeking to hide backend services behind reputable infrastructure.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. A trust score from Gridinsoft rates the domain at 0 out of 100, indicating a complete lack of reputation. The SSL certificate in use is identified as “WE1”, confirming that encrypted HTTPS communication is available despite the site’s malicious purpose. VirusTotal analysis reports that three of ninety‑three security vendors have flagged the domain, providing additional independent confirmation of malicious activity.

The combination of a brand‑targeted page title, low trust score, blocklist presence, and multiple vendor detections supports the classification of this site as a crypto‑related phishing operation. However, the limited number of blocklist entries and the relatively low detection count leave uncertainty regarding the scale of the campaign and whether additional infrastructure is being used. Defenders should continue to monitor the IP address 172.67.153.54 for any re‑activation of the domain or related subdomains, enforce outbound filtering for traffic to the Ethereum brand, and update detection rules to include the observed page title and SSL certificate identifier.