dragonverse[.]live

Analysis indicates that dragonverse.live is an active generic phishing domain with a high risk rating. The site was registered on March 13, 2026 through NiceNIC International Group Co., Limited and resolves to IP 172.67.197.114, which belongs to Cloudflare's network (AS13335). The domain uses Cloudflare nameservers (emely.ns.cloudflare.com, mcgrory.ns.cloudflare.com) and serves content over HTTPS with a Let’s Encrypt certificate (E8). Technical fingerprint shows a modern JavaScript stack: Node.js, Vue.js, Nuxt.js, Underscore.js, and HTTP/3, with HSTS and Cloudflare Browser Insights enabled. The HTTP response is a 301 redirect, and the page title returned is “DragonVerse”. These characteristics are consistent with a front‑end that mimics legitimate services to harvest credentials. Threat intelligence sources have placed the domain on two public blocklists, PhishDestroy and ScamSniffer, and VirusTotal reports three detections out of ninety‑five scanners. The low Gridinsoft trust score of 0/100 further corroborates malicious intent. However, the limited number of vendor detections leaves open the possibility that some detection engines have not yet identified the payload, and the exact phishing campaign details (targeted brand, credential collection method) remain unknown. Defenders should block network traffic to 172.67.197.114 and add dragonverse.live to URL filtering and email security policies. Monitoring for DNS queries to the domain and for TLS connections using the Let’s Encrypt certificate can provide early warning. Incident response teams should assume credential harvesting and advise users to avoid entering login information on the site, and to reset any credentials potentially exposed.