incentive-upshift[.]xyz

Analysis of incentive-upshift.xyz, created on February 24, 2026 and hosted behind Cloudflare (AS13335) in the United States, shows a high‑risk delivery‑scam profile. The domain resolves to the IP address 188.114.97.3, which is owned by Cloudflare, Inc., and is served over HTTP/3 with a Google Trust Services / WE1 SSL certificate. The site returns an HTTP 403 status and presents a page title of “Just a moment…”, indicating that the content is being shielded by Cloudflare’s challenge page rather than exposing a visible payload. Infrastructure signals are consistent with many abuse‑hosting operations that rely on Cloudflare’s reverse‑proxy to hide the true server location.

Reputation data further corroborates malicious intent. VirusTotal records three detections out of ninety‑three scanning engines, and the domain appears on three independent security blocklists. It is explicitly blocked by PhishDestroy, MetaMask, and SEAL, all of which categorize it as a delivery‑related scam. The registrar is Dynadot LLC, and the nameservers kianchau.ns.cloudflare.com and nena.ns.cloudflare.com are standard Cloudflare delegations.

The Gridinsoft trust score of 0 / 100 provides an additional quantitative indicator of extreme risk. While the exact phishing page content has not been disclosed, the combination of a recent registration, use of Cloudflare’s protective services, low trust score, multiple vendor detections, and inclusion on specialized blocklists strongly suggests that the domain is being used to lure victims into a fraudulent delivery scheme.

Defenders should block all traffic to incentive-upshift.xyz at the network perimeter, add the domain to URL filtering policies, and monitor for any outbound connections to the underlying IP address 188.114.97.3. Incident response teams should treat any user‑reported interactions with this domain as malicious and advise affected users to change compromised credentials.