dapp[.]ultiland[.]network

The domain dapp.ultiland.network is currently listed as an active high‑risk generic phishing site. It appears on a single security blocklist and has been flagged by PhishDestroy. Risk assessments from multiple sources assign a high confidence score, and the Gridinsoft trust rating is 0 / 100, indicating a malicious profile. Network resolution points to the IPv4 address 172.67.188.81, which belongs to AS13335, a Cloudflare‑operated network located in the United States. The TLS handshake presents a certificate issued by Google Trust Services under the WE1 label, confirming the use of a publicly trusted certificate chain. Detected web technologies include Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support. HTTP responses from the site return a 403 status code, and the only observed page title is “Just a moment…”, a pattern frequently associated with automated challenge pages. The intelligence tags the operation as a DeFi scam, aligning with the generic_phishing classification. VirusTotal reports a single positive detection out of ninety‑five scanners, which is low but consistent with fast‑changing phishing infrastructure. Observations are limited to the infrastructure and metadata; the actual content served to victims has not been captured, leaving the precise luring technique and target assets uncertain. The low detection count on VirusTotal suggests the site may be newly deployed or employing evasion techniques, while the presence on a blocklist and the zero trust score reinforce its malicious intent. Defenders should add dapp.ultiland.network to outbound and inbound blocklists, enforce DNS sinkholing, and monitor traffic to the associated IP range. Continuous re‑scanning with multiple engines is advised to capture any content changes. Given the high risk rating, organizations handling DeFi assets should treat any interaction with this domain as potentially compromising.