ultraview[.]sa[.]com

The domain ultraview.sa.com was registered on February 21, 2026 and is presently taken offline according to the latest intelligence. It resolves to the IP address 162.241.114.35, which is hosted in the United States under AS19871 (Network Solutions, LLC). The site presents a page titled “DocuSign Secure Access Utility | Document Signing Security,” indicating a credential‑phishing attempt targeting DocuSign users. Evidence shows the domain appears on one security blocklist and is explicitly listed as blocked by PhishDestroy.

VirusTotal analysis records 11 of 93 participating security vendors flagging the domain, reinforcing its malicious classification. The SSL certificate for the host received an R13 rating, and the Gridinsoft trust score is 0 out of 100, both of which suggest a lack of legitimate security posture. The threat is categorized as credential phishing, consistent with the observed page title that mimics a legitimate DocuSign utility.

Defenders should add the domain and its associated IP to blocklists, monitor for any re‑registration attempts, and ensure that web filtering solutions reference the current blocklist entries. Network traffic to 162.241.114.35 should be inspected for anomalous activity, and endpoint protection tools should be updated to reflect the 11 vendor detections reported by VirusTotal. Because the site is offline, immediate exploitation risk is reduced, yet the infrastructure may be repurposed; continuous vigilance is advised.