cumbaya[.]xyz

This domain, cumbaya.xyz, is currently flagged as an active phishing threat targeting Web3 and cryptocurrency users. Registered on May 6, 2026, through Dynadot Inc, the domain resolves to IP address 104.21.23.22, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The site presents itself under the page title 'Web3 Connect Demo,' suggesting an intent to mimic legitimate Web3 authentication or wallet connection interfaces, though the exact content and functionality remain unconfirmed at this stage. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3 support, which is consistent with modern phishing operations seeking to evade detection and enhance performance. The domain employs a Let's Encrypt SSL certificate (YR1), providing HTTPS encryption, a common tactic to appear legitimate. A 301 HTTP redirect is currently in place, which may indicate an attempt to funnel visitors to a secondary malicious endpoint or obfuscate the final destination. The domain is associated with nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, and has been flagged by five security vendors on VirusTotal, though the specific detection signatures or behaviors are not detailed in available intelligence. It appears on at least one security blocklist, including PhishDestroy, and holds a trust score of 0/100 according to Gridinsoft, further supporting its classification as high-risk. Defenders should treat this domain as an active threat. Recommended actions include blocking resolution at the DNS level, updating endpoint protection signatures, and monitoring for connections to the IP address 104.21.23.22 or related infrastructure. Given the Web3 context, users should be cautioned against interacting with any authentication prompts or wallet connection requests originating from this domain.