klayden[.]io

Analysis of the domain klayden.io indicates it was actively used for crypto-related phishing operations prior to being taken offline. The domain was registered on February 26, 2026, through NAMECHEAP INC, with nameservers pointing to amsbs3.hostwindsdns.com and amsbs4.hostwindsdns.com, a configuration associated with Hostwinds LLC hosting infrastructure. The site resolved to the IP address 185.145.97.49, located in the Netherlands, and was served over HTTP/3 using LiteSpeed web server technology. The page title, 'Klayden Crypto Payments | Fast, Secure Wallet,' explicitly suggests a focus on cryptocurrency wallet services, aligning with the 'Crypto Scam' classification provided in threat intelligence sources. The domain was flagged by one security blocklist and assigned a trust score of 0/100 by Gridinsoft, indicating high confidence in its malicious nature.

PhishDestroy also blocked the domain, further corroborating its use in phishing activity. A single security vendor on VirusTotal detected the domain as malicious, though the limited detection count does not diminish the evidence of abuse. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its free and automated issuance process. As of July 25, 2026, klayden.io is offline, reducing immediate risk to end users.

However, defenders should monitor for re-activation or migration of the phishing infrastructure to new domains or IPs. The use of Hostwinds hosting and NAMECHEAP registration is consistent with patterns observed in other phishing campaigns, and security teams are advised to review logs for connections to 185.145.97.49 or related domains. No specific brand impersonation beyond the 'Klayden' naming convention was confirmed in the available data, and the exact mechanics of the scam (e.g., credential harvesting, wallet drainer) remain unanalyzed due to the lack of page content review.