Analysis of ultrasolspin.com shows a newly registered domain (creation date July 26, 2026) that is currently active and hosted on Cloudflare infrastructure, resolving to IP address 104.21.29.224. The authoritative nameservers are andronicus.ns.cloudflare.com and gemma.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. Registration was performed through TUCOWS.COM, CO., indicating a registrar that is frequently used for throw‑away domains.
VirusTotal reports a single positive detection out of 91 security vendors, which alone provides limited confidence; however, the domain appears on two external security blocklists and is explicitly blocked by PhishDestroy and SEAL, reinforcing its malicious classification as a generic phishing site. The limited detection footprint suggests that many security products have yet to flag the domain, but the presence on reputable blocklists and the rapid inclusion by dedicated anti‑phishing services elevate the risk to high. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or brand targeting is presently available, leaving the exact phishing campaign content unknown.
Defenders should immediately add ultrasolspin.com to outbound and inbound filtering rules, ensure that DNS sinkhole or proxy solutions block resolution to 104.21.29.224, and monitor for any future indicator updates from threat Intel feeds. Continuous re‑evaluation is advised, as additional vendor detections or content analysis could raise the detection confidence and inform broader response actions.