ultraapp[.]biz

Analysis of ultraapp.biz indicates a recently established phishing domain with elevated risk indicators. The domain was registered on February 21, 2026, and is currently offline, though it previously resolved to IP 76.76.21.164, an address assigned to Vercel, Inc. in the United States. Infrastructure analysis reveals the use of an SSL certificate classified as R11, a non-standard designation that may signal automated or low-trust issuance, though further certificate details are not available in the current dataset. Detection data shows the domain is flagged by one of 93 security vendors on VirusTotal, a minimal but non-zero signal that aligns with its presence on a single security blocklist.

The domain is explicitly blocked by PhishDestroy, reinforcing its classification as malicious. The page title, 'xblDqN,' provides no recognizable brand or service context, and no additional content analysis has been conducted to determine the specific phishing lure or target. The absence of widespread vendor detections does not indicate safety; rather, it suggests the domain may have been operational for a limited time or evaded broader detection during its active window. Defenders should treat this domain as confirmed malicious based on its blocklist status and hosting on a known provider frequently abused for phishing infrastructure.

While the exact phishing kit or target remains unconfirmed, the combination of recent registration, Vercel hosting, and security vendor flags warrants immediate blocking in enterprise environments. Given its current offline status, further monitoring for reactivation is recommended, particularly if the domain reappears on the same IP or with similar SSL characteristics. No evidence links this domain to a specific brand or scam subtype beyond its generic phishing classification.