ulttester[.]com

This domain, ulttester.com, is assessed as an offline phishing infrastructure targeting Ulta Rewards users, based on the detected page title 'Ulta Rewards Check'. Registered on February 23, 2026, through NiceNIC International Group Co., Limited, the domain resolved to a single IP address, 185.158.133.1, hosted on Cloudflare's network (AS13335) in Poland. Analysis indicates the use of Cloudflare nameservers (keanu.ns.cloudflare.com, nena.ns.cloudflare.com) and HSTS implementation, alongside a Google Trust Services SSL certificate (WE1). At the time of investigation, the domain was flagged by two of 93 security vendors on VirusTotal and appeared on one security blocklist, contributing to its elevated risk classification.

The domain has since been taken offline, as confirmed by PhishDestroy blocking mechanisms. Defenders should note the domain's association with Cloudflare's infrastructure, which is frequently leveraged to obscure hosting origins and evade detection. The SSL certificate, while valid, does not mitigate the phishing risk, as it is issued by a trusted provider and does not indicate legitimacy. The page title suggests a focus on credential harvesting or reward program fraud, though the exact content and functionality of the phishing kit remain unanalyzed.

Given the domain's offline status, immediate takedown actions appear successful, but historical DNS and WHOIS records should be preserved for forensic purposes. Organizations should monitor for re-registration or reuse of this domain or similar infrastructure, particularly under the same registrar or hosting provider. No evidence of widespread distribution or victim reporting is currently available, but the domain's presence on a security blocklist warrants retrospective log reviews for connections from internal networks.