glassnodes[.]icu

The domain glassnodes.icu was observed as an offline infrastructure element linked to a brand‑impersonation campaign targeting Bybit users. Registration data shows the domain was created on July 23, 2025 through NameSilo, LLC, and the hosting service resolves to the IP address 104.21.77.5, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title "Glassnode," but no additional content has been captured, and the current HTTP status indicates the service is taken offline. An SSL certificate identified as WE1 was present on the host, confirming the use of HTTPS for the site.

Threat intelligence records list the scam type as a crypto scam, consistent with the Bybit impersonation claim. VirusTotal analysis recorded two detections out of ninety‑three security vendors, providing limited but notable confirmation of malicious intent. The domain appears on four external security blocklists and has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the classification as highly untrustworthy.

While the offline status limits immediate active threat exposure, the combination of a recent registration, Cloudflare hosting, low trust score, and partial VirusTotal detections suggests the domain was deliberately provisioned for a short‑lived phishing operation. Defenders should continue to monitor the domain for any re‑activation, ensure that outbound traffic to the associated IP is restricted, and add the domain and its IP to internal blocklists. Additional investigation of related subdomains or similar naming patterns may reveal further components of the campaign.