upshiftv2[.]app

The domain upshiftv2.app is currently active and has been classified as a delivery_scam with a high risk rating. Intelligence sources identify the campaign as a shipping scam, wherein victims are lured with false order confirmations and subsequently asked to provide personal or payment information. The site presents a generic page titled “Just a moment…” and returns HTTP status code 403 for direct requests. Domain registration occurred on March 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative name servers are amber.ns.cloudflare.com and patrick.ns.cloudflare.com, indicating Cloudflare DNS hosting. The domain resolves to IP address 188.114.97.3, which is owned by Cloudflare, Inc. and geolocated to Canada. TLS is provided by a Let’s Encrypt certificate (E7), and the Gridinsoft trust score is 0 out of 100, reflecting a lack of legitimacy. VirusTotal analysis shows that 2 of 95 security vendors have flagged the domain, and the indicator appears in a single security blocklist as well as one AlienVault OTX pulse. PhishDestroy has already added the domain to its blocklist. The HTTP 403 response, combined with the low trust score and limited vendor detections, suggests that the site may be employing JavaScript challenges or redirection mechanisms to evade automated scanning while still delivering the scam payload to human visitors. Defenders should immediately block upshiftv2.app at the DNS and proxy layers, and consider blacklisting the associated IP 188.114.97.3 to prevent collateral traffic from reaching the Cloudflare edge. Continuous monitoring of the domain’s DNS records is advised, as the attacker could pivot to additional IPs under the same Cloudflare account. Updating intrusion detection signatures with the observed page title and HTTP 403 pattern will improve detection of similar delivery‑scam infrastructure.