umbraproject[.]xyz

Analysis of the domain umbraproject.xyz indicates it was actively involved in a cryptocurrency scam impersonating an Umbra airdrop, as evidenced by its page title 'Umbra Airdrop || Incognito Mode for Your Finance' and classification as an 'Airdrop Scam' in threat intelligence sources. The domain was registered on December 27, 2025, through NameCheap, Inc., and resolved to the IP address 172.67.166.51, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data transmission. As of the report date, the domain is offline, though it was previously flagged by 15 of 93 security vendors on VirusTotal and blocked by PhishDestroy.

It also appeared on at least one security blocklist, suggesting prior malicious activity. Infrastructure analysis reveals the use of Cloudflare nameservers (edna.ns.cloudflare.com and jim.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The short lifespan of the domain—less than seven months from registration to takedown—aligns with patterns observed in ephemeral phishing campaigns.

While the exact content of the site remains unanalyzed beyond its page title, the combination of a crypto-themed scam, lack of SSL, and Cloudflare hosting indicates a deliberate attempt to deceive users into disclosing sensitive information or transferring cryptocurrency. Defenders should treat this domain as malicious and monitor for related infrastructure, particularly newly registered domains under NameCheap using Cloudflare services. The absence of an SSL certificate and the domain's presence on blocklists further justify its classification as an elevated-risk threat.