ulvionen[.]digital

The domain ulvionen.digital was registered on February 22, 2026 through Dynadot LLC and is currently resolved to the IP address 172.67.175.130, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution uses the Cloudflare authoritative nameservers hugh.ns.cloudflare.com and blakely.ns.cloudflare.com. An HTTPS request to the host returns HTTP status code 200 and presents a TLS certificate issued by Google Trust Services under the WE1 profile, indicating a valid, publicly trusted certificate chain. The page title observed for the site is "Vignette Österreich – Informationen zu Preisen und Kauf," a German‑language phrase that does not directly reveal a targeted brand or service. Technical fingerprinting shows the presence of Cloudflare Browser Insights, standard Cloudflare services, and HTTP/3 support.

From a threat intelligence perspective the domain is classified as a high‑risk generic phishing site and is marked as active. It appears on one external security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis reports that one out of ninety‑five scanning engines flagged the domain, while the Gridinsoft trust score is recorded as 0 / 100, reinforcing the suspicion of malicious intent. No additional detection vendors, Safe Browsing listings, or Open Threat Exchange (OTX) references are provided.

Given the limited public content, the exact phishing narrative and any credential‑harvesting mechanisms remain unknown. However, the combination of a newly registered domain, Cloudflare‑hosted infrastructure, a valid SSL certificate, and an observed page title that could be leveraged to lure German‑speaking users suggests a purposeful attempt to deceive victims. Defenders should prioritize blocking the domain and its associated IP address at perimeter firewalls and DNS filtering layers.