dao-hylo[.]xyz

Analysis dated July 22 2026 flags the domain dao-hylo.xyz as a brand-impersonation site targeting the Compound platform. The domain was registered on February 21 2026 and currently resolves to the Cloudflare address 104.21.64.1 (AS13335, United States). The SSL certificate presented is identified as “WE1”, indicating the use of a generic or possibly self-signed certificate rather than a brand-validated one. HTTP requests to the host return no content because the site is listed as offline at the time of analysis. Open-source threat feeds have already added dao-hylo.xyz to two security blocklists; it is flagged by PhishDestroy and ScamSniffer, and the domain appears on two additional public blocklists.

On VirusTotal the domain received detections from five of ninety-three scanning engines, reinforcing the suspicion of malicious activity. Gridinsoft assigns a trust score of zero out of one hundred, the lowest possible rating, which aligns with the other indicators. The page title returned from the server is “Hylo — Community Vote”, a phrase that does not reference the targeted brand and suggests that the site may be using a generic community-voting interface as a lure. The listed scam type is “Crypto Scam”, and the brand target is explicitly recorded as Compound, confirming that the operator intends to impersonate or otherwise exploit the Compound brand. No further content analysis is available because the site is offline, so the exact technique (e.g., credential harvesting, malicious smart-contract redirection) cannot be confirmed.

Given the observable infrastructure, defenders should block the domain name and its resolved IP address at perimeter and DNS layers, add the host to internal blocklists, and monitor for any future re-hosting on other Cloudflare IP ranges. Continuous re-scanning on VirusTotal and other multi-engine platforms is advised to capture any changes in detection ratio.