txnrelay[.]org

This domain, txnrelay.org, is identified as a crypto drainer targeting users of decentralized finance platforms by impersonating the legitimate Decentralized Layer service. The site employs deceptive interfaces to trick victims into connecting cryptocurrency wallets, enabling unauthorized transactions that drain funds without consent. Analysis of the domain reveals malicious intent through its fraudulent representation of a trusted blockchain infrastructure provider, specifically designed to exploit users seeking decentralized transaction relay services. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on March 19, 2026, through Ultahost, Inc., and resolves to the IP address 188.114.97.3. It is flagged by 6 out of 95 security vendors on VirusTotal, appears on one security blocklist, and has a trust score of 0/100. Detected technologies include Bootstrap, jsDelivr, jQuery CDN, jQuery, Cloudflare Browser Insights, Cloudflare, and HTTP/3, which are commonly used to enhance phishing site credibility and evade detection. Users who visited txnrelay.org should immediately revoke any wallet connections made through the site and monitor their cryptocurrency accounts for unauthorized transactions. It is recommended to conduct a full scan of any device used to access the domain for malware or unauthorized extensions. If assets were transferred, report the incident to relevant blockchain analytics platforms and local cybercrime authorities. Avoid reusing credentials or wallet addresses associated with this domain to prevent further exploitation.