hyloso[.]run

Analysis of the domain hyloso.run indicates that it was registered on 21 February 2026 and resolves to the IP address 104.21.9.21, which belongs to Cloudflare, Inc. (AS13335) located in the United States. The site presented the page title “Hylo | Leverage” and is associated with a wallet/seed phishing campaign that claims to impersonate the brand across. The domain received a Gridinsoft trust score of 0 out of 100, and its SSL certificate is identified as WE1. Independent scanning on VirusTotal recorded nine detections out of ninety‑three security vendors, confirming malicious intent.

The domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer, and has been listed on additional security blocklists referenced in the intelligence feed. Current network observations show the host is taken offline, but the infrastructure—Cloudflare front‑end and the low trust score—suggests the operators intended rapid deployment and easy takedown. Defenders should add 104.21.9.21 to network deny lists, enforce DNS filtering for hyloso.run, and monitor for newly registered domains that resolve to the same Cloudflare AS13335 range with similar low trust scores.

Because the campaign targets cryptocurrency wallet seeds, any credential or seed capture attempts originating from this host should be treated as compromised. Continuous re‑query of VirusTotal and blocklist sources is recommended to capture any re‑activation of the domain or related indicators of compromise. Organizations using the across brand should alert users to the existence of this impersonation attempt and advise against entering wallet credentials on unverified sites.