bitvyn[.]com

Analysis on www.bitvyn.com indicates the site was used for a cryptocurrency brand impersonation campaign targeting Ethereum users. The domain was registered on 21 February 2026 and resolves to the Cloudflare‑owned address 104.21.78.211, associated with ASN 13335 in the United States. The TLS certificate presented is identified as WE1, confirming the use of HTTPS. The page title retrieved during the last scan reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Bitvyn”, which aligns with the declared scam type of a crypto scam.

VirusTotal recorded nine positive detections out of ninety‑three scanners, confirming malicious classification by multiple vendors. The domain is listed on a single security blocklist and received a Gridinsoft trust score of 0 out of 100, indicating extreme risk. PhishDestroy has actively blocked the domain, and the current HTTP status is offline, suggesting the site has been taken down or is no longer serving content. Evidence of brand impersonation is explicit: the domain claims to offer cryptocurrency services while mimicking the Ethereum brand, as reflected in the page title and the “Impersonates: Ethereum” label.

No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange references, or registrar details are available. Defenders should continue to block the domain at network perimeter, update URL filtering lists, and monitor the associated IP address for any re‑use. Because the site is already offline, immediate threat mitigation focuses on preventing residual phishing links from being accessed and ensuring that endpoint protection solutions recognize the nine vendor detections. Ongoing observation of Cloudflare‑hosted IP ranges for new domains with similar characteristics is recommended.