mtytyynh[.]help

Analysis of the domain mtytyynh.help, observed on July 23, 2026, indicates an elevated‑risk crypto‑related impersonation campaign targeting the Ethereum brand. The domain was registered on October 09, 2025 through NameSilo, LLC and resolves to the Cloudflare‑owned IP address 172.66.0.225, which is associated with ASN 13335 in the United States. DNS resolution is served by gannon.ns.cloudflare.com and zariyah.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. No TLS certificate was found for the domain, suggesting the site was operating without HTTPS protection at the time of collection.

The page title returned by the HTTP response reads "Buy, sell & trade Ethereum and other top tokens on Uniswap," directly referencing the Ethereum brand and a popular decentralized exchange, reinforcing the classification as a brand‑impersonation crypto scam. VirusTotal scans recorded 13 detections out of 95 security vendors, providing independent corroboration of malicious intent. The domain appears on a single security blocklist and has been flagged by the PhishDestroy blocklist, further evidencing its abuse. AlienVault OTX lists the domain in one threat‑intel pulse, underscoring its presence in the broader threat‑intel community.

Current operational status is offline, indicating that the site has been taken down or is otherwise inaccessible, but the underlying infrastructure remains observable. Defenders should continue to block the domain at network perimeters, update DNS sinkhole configurations to null‑route 172.66.0.225, and monitor for any re‑registration attempts or similar impersonation patterns leveraging the Ethereum name.