foundation-umbraprivacy[.]com

PhishDestroy identifies foundation-umbraprivacy.com as an active brand impersonation domain specifically targeting the Umbra airdrop campaign. This domain is designed to deceive users into connecting wallets or providing private keys under the guise of an official Umbra airdrop offer. As of this assessment, the domain remains active and operational, actively engaging in crypto-based fraud under investigation.

This domain was flagged by 1 of 95 VirusTotal vendors, indicating it has not yet been widely recognized as malicious by mainstream security tools. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 104.21.12.219 and was created on April 18, 2026. Protective monitoring shows no current presence on major blocklists and no available trust scores, reflecting its recent emergence and low detection footprint. The combination of a fraudulent page title (Umbra Airdrop), recent creation date, and low AV detection raises serious concerns about its intent and potential impact.

Given the high-risk nature of this impersonation and its deployment in crypto drainer tactics, PhishDestroy recommends immediate action. Users should avoid interacting with foundation-umbraprivacy.com entirely. Organizations and individuals are advised to block this domain at the network level, report it to relevant authorities such as IC3 or local cybercrime units, and conduct phishing awareness training emphasizing verification of airdrop campaigns only through official channels. Enhanced monitoring of outbound traffic to 104.21.12.219 is strongly recommended. This domain is under active investigation and remains high-risk due to its current operational status and lack of detection coverage.