ultrabasefirmware[.]com

Analysis of ultrabasefirmware.com indicates that the domain is part of a high‑risk crypto‑scam infrastructure that has been taken offline as of the report date. The domain was registered on 29 October 2025 through NiceNIC International Group Co., Limited and has never presented an SSL certificate, leaving all traffic unencrypted. DNS resolution points to 104.21.66.8, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. Authoritative nameservers betty.ns.cloudflare.com and conrad.ns.cloudflare.com confirm the use of Cloudflare’s DNS services, a common choice for malicious operators seeking rapid deployment and concealment.

Multiple defensive feeds have flagged the domain: it appears on four security blocklists and has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. Reputation scoring from Gridinsoft rates the domain at 0 out of 100, indicating an extreme lack of trust. VirusTotal analysis shows that 12 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity despite the relatively low detection count.

The identified scam type is a crypto‑scam, suggesting attempts to lure victims into fraudulent cryptocurrency transactions or credential harvesting. No HTTPS certificate, combined with the low trust score and blocklist presence, points to a deliberately low‑profile operation that relied on domain‑fronting through Cloudflare’s network.

Uncertainties remain regarding the exact payload or phishing kit employed, as no page title or content analysis is available. Consequently, defenders cannot confirm the specific phishing lure or the exact victim‑targeted brand. However, the convergence of registrar data, IP ownership, blocklist inclusion, and multi‑vendor detections provides a strong indication of malicious intent.

Recommendations for security teams include adding ultrabasefirmware.