testnet[.]humanitiye[.]xyz

Analysis of testnet.humanitiye.xyz shows a newly registered domain created on February 21, 2026 that was used to host a wallet/seed phishing page titled "Login | Humanity Protocol." The site resolved to the IP address 172.67.205.193, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The SSL certificate presented is identified as WE1, indicating a standard Cloudflare issuance. VirusTotal records indicate that six out of ninety-three scanning engines flagged the domain, reinforcing the suspicion of malicious activity.

Independent reputation services have assigned extremely low trust scores: Gridinsoft reports a score of 1 out of 100, and Scamadviser mirrors this rating, suggesting a high likelihood of abuse. The domain appears on five security blocklists and is actively blocked by services such as PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. Current status shows the domain has been taken offline, but its infrastructure—particularly the use of a shared Cloudflare edge—remains reusable for future campaigns.

Defenders should continue to block the IP 172.67.205.193 at the network perimeter, monitor for re‑registration attempts, and add the domain to internal blacklist feeds. Continuous observation of Cloudflare‑hosted assets associated with the same ASN is advised, as threat actors often recycle such infrastructure for new phishing deployments.