# txnrelay.org — SUSPICIOUS

> PhishDestroy identifies txnrelay.org as a crypto drainer impersonating Decentralized Layer™. VirusTotal shows 0/95 detections as of March 19, 2026.

## Summary
PhishDestroy has flagged txnrelay.org as a live crypto drainer impersonating the Decentralized Layer™ platform, targeting users through deceptive replication of its branding. The domain was registered on March 19, 2026, through Ultahost, Inc., and resolves to IP 188.114.97.3. Notably, it leverages a Google Trust Services SSL certificate to appear legitimate, increasing the risk of user deception. The domain’s recent creation and clean VirusTotal score (0/95 detections) suggest this threat may still be flying under the radar, making it particularly dangerous for unsuspecting visitors.  This domain employs sophisticated tactics to mimic Decentralized Layer’s official site, including the replication of its page title, 'Decentralized Layer™ | Home,' and the use of a trusted SSL provider to enhance credibility. The absence of detections on VirusTotal underscores the stealthy nature of this operation, as threat intelligence platforms have yet to flag its malicious intent. With no blocklist entries recorded, users visiting txnrelay.org may unknowingly expose themselves to crypto drainer scripts designed to siphon funds from digital wallets or harvest sensitive credentials.  If you have visited txnrelay.org, immediately disconnect from the internet, scan your device for malware, and revoke any permissions granted to the site. Do not enter any wallet addresses, private keys, or personal information. Report the domain to your antivirus provider and consider filing a complaint with your local cybercrime unit. Stay vigilant for similar domains mimicking Decentralized Layer™ or other crypto platforms, and verify URLs against official sources before engaging.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Page title: Decentralized Layer™ | Home

## Domain Intelligence
- Registered: 2026-03-19 22:41:27
- Registrar: Ultahost, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/3e991823-f525-43b8-b518-fc0776bec442
- PhishDestroy: https://phishdestroy.io/domain/txnrelay.org/
- LLM endpoint: https://phishdestroy.io/domain/txnrelay.org/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/txnrelay.org/
Last updated: 2026-03-25