verseproofs[.]xyz

This domain, verseproofs.xyz, was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative name servers bristol.ns.cloudflare.com and nitin.ns.cloudflare.com resolve the domain to the Cloudflare‑owned address 188.114.96.3, which belongs to ASN 13335 in the United States. The site presented the HTML page title “Decentralization” before being taken offline. Security telemetry shows the domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis recorded seven positive detections out of ninety‑three scanned scanners, indicating a consensus among multiple vendors that the site is malicious. The TLS certificate is issued by Google Trust Services under the WE1 label, and the service supports HTTP/3, confirming the use of modern Cloudflare infrastructure. The combination of blocklist presence, vendor detections, and the generic “Decentralization” title suggests the site was employed for a generic phishing campaign, although the exact lure or credential‑stealing vector has not been publicly disclosed. Because the domain is currently offline, real‑time content cannot be examined, and the specific phishing kit or target audience remains uncertain.

Defenders should continue to deny any outbound connections to the IP 188.114.96.3, enforce blocklist rules that include verseproofs.xyz, and monitor for re‑registration or resurrection of the domain. Adding the domain to internal threat‑intel feeds and alerting SOC analysts when DNS queries for the name appear will help mitigate potential re‑use. Ongoing observation of the associated ASN and Cloudflare edge locations is advised, as threat actors frequently leverage the same infrastructure for new campaigns.