ubshi[.]com

This domain, ubshi.com, is actively flagged as a high-risk phishing site targeting users of UBS, a major financial institution. Registered on May 18, 2026, through Gname.com Pte. Ltd., the domain resolves to 188.114.96.3, a Cloudflare-hosted IP located in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (priscilla.ns.cloudflare.com and trevor.ns.cloudflare.com), a common tactic to obscure hosting origins and evade detection. The domain presents a page titled 'UBS,' strongly suggesting an attempt to impersonate the legitimate UBS brand for credential harvesting or fraudulent transactions. The domain is currently active, returning an HTTP 200 status, and is listed on three security blocklists, including PhishDestroy, MetaMask, and SEAL. While only one of ninety-five security vendors on VirusTotal flags the domain, this limited detection does not diminish its threat level, as phishing campaigns often employ evasion techniques to delay or avoid widespread detection. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate the legitimacy of the site, as phishing domains frequently use valid certificates to appear trustworthy. Analysis of threat intelligence sources indicates the domain has been included in at least one AlienVault OTX pulse, further corroborating its malicious classification. The combination of brand impersonation, Cloudflare infrastructure, and blocklist presence aligns with known phishing tactics targeting financial institutions. Defenders should treat this domain as a confirmed threat and prioritize blocking or monitoring access to it. Network-level protections, such as DNS filtering or IP-based restrictions, are recommended to mitigate exposure. End-user awareness campaigns should emphasize verifying domain authenticity before entering credentials, particularly for financial services.