# PhishDestroy domain threat record: bullverse.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bullverse.de/
Machine-readable companion: https://phishdestroy.io/domain/bullverse.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-08-26 09:59:57 UTC
- Last availability or vendor check: 2026-10-23 10:34:11 UTC
- Stored record updated: 2026-10-23 18:20:53 UTC
- VirusTotal detections in the stored snapshot: 5/91
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: shopify

## Stored infrastructure

- Observed IP address: 23.227.38.65
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a03d81-b29f-71a8-94bb-d6bf9de22302/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bullverse.de
- Certificate Transparency search: https://crt.sh/?q=%25.bullverse.de
- Web Archive lookup: https://web.archive.org/web/*/https://bullverse.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
bullverse.de is an impersonation phishing page aimed at people in the crypto space. Both MetaMask and the SEAL security alliance list it, which places its intended victims among wallet users. PhishDestroy first detected it on 2026-08-26. As of 2026-10-19 the site was still online and serving its content, so it remains a live risk.

How the scam works
The page carries the title "SyltTech", a name unrelated to the domain itself. We classified the site as impersonation because it presents itself as an established service. Pages of this kind copy a legitimate brand's look so visitors trust it enough to log in, enter a recovery phrase, or connect a wallet and sign whatever prompt appears. Whatever is typed or approved goes straight to the operators. A leaked seed phrase or a signed malicious approval can let them empty a wallet with no further action from the victim.

Evidence
Wallet-security blocklists provide the strongest confirmation here. MetaMask and SEAL both flag the domain alongside PhishDestroy, and Spamhaus lists it in its domain blocklist under the phishing category. On VirusTotal, 5 of 91 engines flagged it as of 2026-10-06: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. That count is low, so most generic scanners would still let a visitor through without a warning. The domain also appears in 4 AlienVault OTX threat pulses, which shows other researchers are tracking it.

Infrastructure
The site resolves to 23.227.38.65 on Cloudflare, Inc. network space located in Canada. It runs under a German country-code domain, a choice unrelated to its hosting location. The Let's Encrypt certificate (YE1) means the padlock icon shows up as normal, and that padlock says nothing about whether the site is honest.

What to do
If you connected a wallet to bullverse.de, open a token-approval checker and revoke any permissions you granted it. Then move your remaining funds to a fresh wallet. If you typed a seed phrase or private key, treat that wallet as fully compromised and stop using it. If you entered a password, change it everywhere you reused it and turn on 2FA. Defenders should block the domain at DNS and proxy level, add it to mail and web filters, and report it to the hosting provider and the .de registry so it can be taken down.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a03d81-b29f-71a8-94bb-d6bf9de22302/
VirusTotal report: https://www.virustotal.com/gui/domain/bullverse.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bullverse.de
Archived copy: https://web.archive.org/web/20260826100203/https://bullverse.de/en
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:56:01 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/nsthsRQn/c692e8b36258.png
  Captured: 2026-08-26 09:59:57 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a03d81-b29f-71a8-94bb-d6bf9de22302.png
  Captured: 2026-08-26 09:59:57 UTC
  Source report: https://urlscan.io/result/01a03d81-b29f-71a8-94bb-d6bf9de22302/
- URLQuery: https://screenshots.phishdestroy.io/uq/c0a0e560-a137-4424-b4d1-fc067484c8a1.png
  Captured: 2026-08-26 10:06:29 UTC
  Source report: https://urlquery.net/report/c0a0e560-a137-4424-b4d1-fc067484c8a1
  SHA-256: 59427c66a0ff0f501b30c13c8728ea25ec51927b85dc27c548ec9d5631414714
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ffd6879f-293d-46e5-bdbc-c31ecd5d88fd.png
  Captured: 2026-08-26 10:06:44 UTC
  Source report: https://radar.cloudflare.com/scan/ffd6879f-293d-46e5-bdbc-c31ecd5d88fd
  SHA-256: 705971505d44300cf644a7cfa5f022d24aca75e3c9d264fbcda0892c02d59d07
- URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a0382b-fb22-7396-b6d7-12921da93073.png
  Captured: 2026-08-25 09:06:48 UTC
  Source report: https://urlscan.io/result/01a0382b-fb22-7396-b6d7-12921da93073/
  SHA-256: e223dfd97c8e0af590dda256585e3b7c2afc52fb51ae3c55133c8ede09afac76
- URLScan · 2026-08-26: https://screenshots.phishdestroy.io/us/01a03d86-eee7-705e-b6db-79c67936b551.png
  Captured: 2026-08-26 10:04:16 UTC
  Source report: https://urlscan.io/result/01a03d86-eee7-705e-b6db-79c67936b551/
  SHA-256: dd88ffb839a8ee411eb8447666196f32dab6652fdb777b5cbfeeb785f3d3f529

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T04:31:19Z",
        "uuid": "01a03d81-b29f-71a8-94bb-d6bf9de22302",
        "scanned_at": "2026-08-26T09:58:36Z",
        "final_url": "https://bullverse.de/en",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://bullverse.de/",
                "from": "http://bullverse.de/",
                "status": 307
            },
            {
                "to": "https://bullverse.de/en",
                "from": "https://bullverse.de/",
                "status": 302
            }
        ],
        "ip": "23.227.38.65",
        "ptr": "myshopify.com",
        "domains": [
            "cdn.shopify.com",
            "otlp-http-production.shopifysvc.com",
            "monorail-edge.shopifysvc.com",
            "shop.app"
        ],
        "ips": [
            "34.160.147.240",
            "34.149.34.106",
            "23.227.39.200",
            "23.227.39.20",
            "23.227.38.65"
        ],
        "asns": [
            "396982",
            "13335"
        ],
        "countries": [
            "US",
            "CA"
        ],
        "link_domains": [
            "www.facebook.com",
            "www.instagram.com",
            "www.tiktok.com",
            "x.com",
            "www.youtube.com"
        ],
        "social": [
            "https://www.facebook.com/shopify",
            "https://www.instagram.com/shopify",
            "https://www.tiktok.com/@shopify",
            "https://x.com/shopify",
            "https://www.youtube.com/shopify"
        ],
        "doc_hash": "2429aaf091eadc0af210a30b7a4814a3e6a67eee31b42c77261c5edf90139ec5",
        "script_hashes": [
            "a1d9d1669ffb7c158c25da4f5ffa1b34b2094f68639b6816cdd47495b7d38f1f",
            "7cdbe90bde65b015d4f7b0bad8e93815db2f0e46d8092285715f5c677aab6b5f",
            "26fcfccc0c1cc155144de3f7b871dc075edd24c32d93f76978389ad88314a9e3",
            "da5684e828477a0cfb4a14e2749cf949ed6d006388b4a0c7633fdc93aee5938f",
            "2213f2d7b7e6d7003729c9f28d5867c7d3bdef162d14a5ee12dd3af42c3e6841",
            "f9623a2125185330fce3fc47cde38c2de119eac89337e21d8285f43de6be7d91",
            "269bfe2d941090a893ba12e5072da13289d42c78e0d379c87ecf409fa15028ab",
            "e9d018c467ece6518724f831ed425bd8b9351083724e0fc640412168ca680651",
            "6ce8d5b526956dc6bf4b3a9f7733849d7f148687adfd5a594417ecfb378c4475",
            "ed638cc0e4e076a88f2f3240b7dfce3a3edee1a2eebb37671233d403474295cc"
        ],
        "globals": [
            "ontouchcancel",
            "ontouchend",
            "ontouchmove",
            "ontouchstart",
            "Shopify",
            "ShopifyPay",
            "__st",
            "ShopifyPaypalV4VisibilityTracking",
            "ShopifyAnalytics",
            "portableWalletsHideBuyerConsent",
            "portableWalletsShowBuyerConsent",
            "__pagefly_heatmap_config__",
            "__TREKKIE_SHIM_QUEUE",
            "meta",
            "attr",
            "trekkie",
            "calculateHeaderGroupHeight",
            "esmsInitOptions",
            "privacyBanner",
            "__core-js_shared__",
            "core",
            "PAGEFLY_CRO",
            "_pf_getDevice",
            "_pf_asyncWait",
            "_pf_mergeDeep",
            "_pf_getElemIdByClassname",
            "_pf_debounce",
            "_pf_getHttpRequest",
            "_pf_getPageTypeFromPFPageSetting",
            "_pf_getCookie",
            "_pf_setVariantUrlParam",
            "_pf_getAssignedAbVariant",
            "_pf_hideElementIfNotFound",
            "_pf_collectionHas",
            "_pf_findParentBySelector",
            "_pf_getOriginalSrc",
            "_pf_loadJS",
            "_pf_uid",
            "_pf_uuid",
            "_pf_loadScript"
        ],
        "cookies": [
            "localization",
            "cart_currency",
            "_shopify_y",
            "_shopify_s",
            "_shopify_analytics",
            "_shopify_marketing",
            "_shop_app_essential",
            "_shopify_essential"
        ],
        "storage_keys": [
            "consentHeader",
            "PF_SHOP_DOMAIN",
            "_shs_state",
            "wpm-ri-acac6892-2677-4d56-9fff-5ef71c82f2e4-1787738306-z",
            "__shopify_agent_context_events",
            "ri-rKxokiZ3TVaf_173HILy5BeHc4MG-z",
            "__webStorageTest__",
            "signInWithShop:cartSyncTransferAttemptedAt",
            "shopify:webmcp_adapter_loaded"
        ],
        "tls": {
            "san": [
                "bullverse.de"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "bullverse.de",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-17T03:47:32Z",
            "valid_from": "2026-08-19T03:47:33Z"
        },
        "domain_age_days": 434,
        "apex_age_days": 434,
        "tls_age_days": 7,
        "tls_valid_days": 89,
        "requests": 323,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 41,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=7889238",
            "content-security-policy": "block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T05:59:06Z",
        "uuid": "ffd6879f-293d-46e5-bdbc-c31ecd5d88fd",
        "scanned_at": "2026-08-26T10:06:44Z",
        "final_url": "https://bullverse.de/",
        "status": 200,
        "history": [
            {
                "url": "https://bullverse.de/",
                "status": 200
            }
        ],
        "dom_hash": "d41ea297ecbff3a275cf0899fb120d53a2cd3d18edf149234b0bf54e69a074f6",
        "doc_hash": "09c105b10109d3cbaec0acc89cd527393f037d913d028f1f85df913b2bf2fdf5",
        "domain_risks": [
            "Information Technology",
            "Technology"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bullverse.de",
                "type": "A",
                "value": "23.227.38.65"
            },
            {
                "name": "bullverse.de",
                "type": "AAAA",
                "value": "2620:127:f00f:5::"
            }
        ],
        "dnssec_valid": false,
        "ip": "23.227.38.65",
        "whois": {
            "updated": "2025-06-16T13:27:35Z",
            "nameservers": [
                "docks10.rzone.de",
                "shades10.rzone.de"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T15:03:49Z",
        "analysis_at": "2026-10-06T02:04:46Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 3,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Google": "shopping",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "business and economy"
        },
        "first_seen": "2025-06-18T13:52:16Z",
        "dns": [
            {
                "ttl": 150,
                "type": "SOA",
                "rname": "hostmaster.strato-rz.de",
                "value": "shades10.rzone.de"
            },
            {
                "ttl": 150,
                "type": "MX",
                "value": "smtpin.rzone.de",
                "priority": 5
            },
            {
                "ttl": 150,
                "type": "NS",
                "value": "docks10.rzone.de"
            },
            {
                "ttl": 150,
                "type": "AAAA",
                "value": "2620:127:f00f:5::"
            },
            {
                "ttl": 150,
                "type": "NS",
                "value": "shades10.rzone.de"
            },
            {
                "ttl": 150,
                "type": "A",
                "value": "23.227.38.65"
            }
        ],
        "dns_at": "2026-10-06T02:04:58Z",
        "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "bullverse.de"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "595a5ee1d70c50b23503d9d356eec20c74c",
            "sha256": "97f4af2171acb23011cdcc1416ed3bf206def4ae75c801e9004d3919d686c719",
            "subject": "bullverse.de",
            "valid_to": "2026-11-17T03:47:32Z",
            "valid_from": "2026-08-19T03:47:33Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2025-06-16T13:27:35Z"
            }
        }
    }
}
```