kalyxen[.]io

The domain kalyxen.io is currently flagged as a high‑risk crypto‑scam phishing site. Infrastructure analysis shows the domain resolves to IP 216.150.1.1, which is hosted in the United States and belongs to ASN 16509, the Amazon.com network. Registration is handled by a CDN provider, and the authoritative name servers (clara.ns.cloudflare.com, nicolas.ns.cloudflare.com) are consistent with that service. A TLS certificate is present, issued by a public certificate authority, and the site responds with an HTTP 307 redirect. The page title returned by the server reads "KALYXEN — The Unified DeFi Protocol," indicating the attacker is attempting to impersonate a decentralized finance platform. VirusTotal reports that 2 of 94 security vendors have flagged the domain, and the Gridinsoft trust score is 0 / 100, reflecting a lack of trust. The domain is listed on at least one public blocklist and is already blocked by a phishing‑mitigation service. Although the exact malicious payload or credential‑harvesting page has not been captured, the combination of a crypto‑scam classification, active status, and confirmed redirection behavior suggests the site is being used to lure victims into disclosing private keys or sending funds. Defenders should immediately block the domain and its hosting IP at network perimeters, incorporate the indicator into endpoint detection rules, and monitor for any related traffic patterns. Continuous re‑evaluation is advised, as additional detection data may emerge.