ultiversedao[.]xyz

Analysis indicates that the domain ultiversedao.xyz was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative name servers max.ns.cloudflare.com and piper.ns.cloudflare.com resolve the zone to the IP address 188.114.97.3, which belongs to Cloudflare’s AS13335 network in the United States. The site was protected by a Google Trust Services certificate (WE1) and was reachable via HTTP/3, confirming its use of Cloudflare’s CDN and edge services. The page title observed during the brief live window was “Ultiverse Rewards Claim”, suggesting an attempt to lure victims with a rewards‑claim narrative. VirusTotal scans recorded 16 detections out of 95 participating vendors, and the domain appears on four independent blocklists – PhishDestroy, MetaMask, ScamSniffer, and SEAL – reinforcing its malicious classification.

Gridinsoft assigned a trust score of 0 out of 100, and AlienVault OTX includes the domain in a single threat‑intel pulse. The overall risk rating is high, and the site has already been taken offline at the time of reporting. Uncertainty remains around the specific phishing kit or payload used, as no additional content analysis or payload hashes have been disclosed. The short lifespan of the site limits the amount of forensic artefacts available, and the use of Cloudflare can obscure the true backend infrastructure. Nonetheless, the convergence of multiple vendor detections, blocklist entries, a zero‑trust score, and the observed “Rewards Claim” page title provides sufficient confidence to treat the domain as a high‑confidence phishing indicator.

Defenders should immediately add ultiversedao.xyz to existing URL filtering, DNS sinkhole, and endpoint block lists. Network monitoring should flag any outbound connections to the IP 188.114.97.3, and TLS inspection rules should be updated to capture the Google Trust Services certificate fingerprint for correlation.