bet-ultradrift[.]club

The domain bet-ultradrift.club was registered on 15 April 2026 through Dynadot Inc. It is served from Cloudflare infrastructure, as indicated by the authoritative nameservers sierra.ns.cloudflare.com and aiden.ns.cloudflare.com and by the resolved address 188.114.96.3, which maps to a Cloudflare location in Canada. The site presents an SSL certificate issued by Let’s Encrypt (certificate identifier E7), and all HTTP requests return a 302 redirect before delivering content whose title is reported as “Document”.

VirusTotal analysis shows that 3 of 95 scanning engines have flagged the domain, and an independent reputation service assigns a trust score of 0 out of 100. The domain is listed on a single public blocklist and is actively blocked by the PhishDestroy mitigation platform. The current operational status is marked as active, and the risk rating is high.

These indicators collectively suggest a phishing campaign that leverages a short-lived domain, legitimate TLS termination via Let’s Encrypt, and Cloudflare’s CDN to obscure the true hosting environment. The low detection count does not preclude malicious intent, but the presence of a redirect and the generic “Document” page title are consistent with credential‑harvesting pages that forward victims to further payloads. The absence of publicly disclosed payloads or associated phishing kits leaves the exact targeting vector uncertain.

Defenders should prioritize blocking bet‑ultradrift.club at network perimeter and DNS layers, enforce strict TLS inspection to verify the certificate chain, and monitor for outbound connections to the underlying Cloudflare IP range. Continuous re‑scanning of the domain with multiple sandboxes is advised to capture any evolving payloads. Organizations that have observed similar redirects should consider user education on unexpected document‑named pages and enforce multi‑factor authentication to mitigate credential compromise.