app-hylo[.]com

This domain, app-hylo.com, operates as a credential harvesting site targeting users of decentralized finance (DeFi) platforms. The site presents a fraudulent interface labeled 'Hylo | Defi Amplified,' designed to mimic legitimate cryptocurrency services. Victims are prompted to enter wallet credentials, private keys, or seed phrases, which are then transmitted to threat actors for unauthorized access and asset theft. The site employs social engineering tactics, leveraging the growing popularity of DeFi to deceive users into disclosing sensitive authentication details. Analysis indicates this domain poses a high-risk threat based on multiple technical indicators. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious infrastructure. As of the latest scan, 10 out of 95 security vendors on VirusTotal have flagged the domain as malicious, with detections categorized under phishing and fraud. The domain appears on four security blocklists, including PhishDestroy and ScamSniffer, and is actively blocked by browser extensions and wallet security tools. Infrastructure analysis reveals the domain resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic used to conceal the true origin of phishing sites. The SSL certificate, issued by Google Trust Services (WE1), is valid but does not mitigate the underlying threat. Users who have visited app-hylo.com or interacted with its content should take immediate action to mitigate potential compromise. First, disconnect any active wallet connections to the site and revoke permissions via the wallet’s connected applications settings. If credentials, private keys, or seed phrases were entered, transfer all assets to a new, secure wallet immediately, as the original may be compromised. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams or platforms, such as cryptocurrency exchanges or wallet providers, to assist in broader threat mitigation efforts. Avoid reusing passwords or keys associated with this domain, and scan local devices for malware that may have been introduced through the interaction.