xn--ve-6kca[.]xn--mppshbr-2fgcd9li3a70yha6062idaj[.]upkyberwallet[.]com

This domain, observed on July 12, 2026, is classified as an active crypto drainer threat with a high-risk designation. Infrastructure analysis reveals the domain was registered on February 21, 2026, through MAT BAO CORPORATION and currently resolves to IP address 104.21.112.1, hosted on Cloudflare's network (AS13335) in the United States. The domain employs Cloudflare nameservers (kallie.ns.cloudflare.com and kyle.ns.cloudflare.com) and utilizes HTTP/3 protocol, with a Let's Encrypt SSL certificate issued under the E8 chain. The page title, 'upkyberwallet.com | 522: Connection timed out,' suggests either deliberate misconfiguration or a temporary outage, which is consistent with evasion tactics used by crypto drainer operations. A 403 HTTP status indicates restricted access, potentially limiting automated analysis. The domain appears on one security blocklist and is explicitly flagged as a crypto scam by at least one vendor. While two of 95 security vendors on VirusTotal have detected malicious indicators, the absence of broader detection does not reduce the assessed risk, as crypto drainers often employ short-lived infrastructure to evade detection. Defenders should treat this domain as hostile infrastructure. The use of Cloudflare does not imply legitimacy, as threat actors frequently abuse its services for anonymity and DDoS protection. Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions. Further monitoring is advised, as the domain remains active and may resume operations under a different configuration. The exact content of the site has not been analyzed, but the classification as a crypto drainer indicates it is likely designed to siphon digital assets from victims' wallets.