umtxrelay[.]xyz

The domain umtxrelay.xyz was registered on February 21, 2026. It resolves to the IPv6 address 2606:4700:3036::6815:29ac, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented is identified as “E1”, indicating a low‑trust or potentially self‑signed certificate. The site’s HTML title reads “Wallet Connect”, matching the declared brand target WalletConnect and the reported scam type of a crypto‑related fraud.

VirusTotal scans returned 13 positive detections out of 93 security vendors, indicating a consensus among multiple scanners that the domain is malicious. The domain is listed on three independent phishing blocklists—PhishDestroy, ScamSniffer, and Enkrypt—providing additional corroboration of its abusive nature. Reputation services assign extremely low trust scores, with Scamadviser rating the site 1 out of 100 and Gridinsoft rating it 0 out of 100. The domain is currently reported as taken offline, which may be a temporary takedown or a shift to a new infrastructure.

The use of Cloudflare’s edge network may provide anonymity and rapid redeployment capabilities, a pattern observed in recent crypto‑draining campaigns. Analysts should continue to enforce blocklist entries, monitor the associated IP range for related activity, and consider adding the domain to internal deny lists. Future DNS resolutions for the same name or similar prefixes should be verified, as the threat actor frequently rotates domains. The combination of recent registration, Cloudflare hosting, low‑trust TLS, multiple vendor detections, and low reputation scores strongly supports classification as a high‑risk crypto‑phishing campaign targeting WalletConnect users.