UltaHost Incident Database

Round 6 documents the June 2026 meltdown: the multi-day outage timeline recorded by independent status trackers, storage-node data loss, the cross-platform reputation gap (Trustpilot 3.4 vs 4.9 on business-review platforms), regional performance benchmarks, and the refund-policy fine print that excludes nearly everything.

Third-party status trackers (StatusGator, EntireWeb, SaaSHub) record repeated “Istanbul Storage Node Degradation” incidents from June 22 onward — UltaHost attributes the extended downtime to failed disks on a storage node and a slow data-rebuild, with concurrent warnings on Amsterdam and Toronto. First logged as a June 22–29 window, the incident continues through July 2–3, making it an 11+ day storage failure: StatusGator flags the Amsterdam and Istanbul nodes as Down and Toronto as degraded — an active, multi-node major outage against the marketed “99.9% uptime guarantee” and the 43.78% uptime measured by WebsitePlanet. In the same window, the BBB letter grade ticks from D to D+ (still not accredited; 6 complaints, failure to respond to ≥1).

Scamalytics rates UltaHost a 37/100 medium fraud-risk ISP — approximately 37% of observed UltaHost traffic flagged as potentially fraudulent across 24,512 tracked IP addresses— the first quantified third-party fraud-scoring signal. The same update documents the casino-hosting own-contradiction (HostAdvice's “Best Online Casino Hosting Providers” list features UltaHost while UltaHost's own ToS prohibits promoting gambling) and the asymmetric enforcement pattern: paying customers' servers suspended without notice on unsubstantiated phishing allegations, while abuse reports against actual bad actors are met with demands for a trademark certificate or court order.

Published IOCs attribute a coordinated Meta/WhatsApp/Instagram fake-job phishing operation (late 2024 — March 2025) to ~50 Ultahost-registered domains— one shared C&C domain (spyder1279.blog), one shared hosting IP, and WebSocket-based 2FA/OTP interception. The same week, WebsitePlanet's 2026 review ranks UltaHost #3752 of 3,860 hosts (bottom 3%) with 43.78% measured uptime and 17 consecutive days down, and a Web Hosting Talk thread documents UltaHost sending legal threats to a customer who won a credit-card chargeback.

Round 5 documents the financial mechanism sustaining UltaHost: 70% affiliate commissions (industry standard 20-40%) paid in cryptocurrency; an Envato/CodeCanyon backdoor pipeline run by the same Doughouz family; a refund policy that pre-classifies chargebacks as “criminal fraud”; and HostAdvice openly listing UltaHost as a top Telegram Hosting service used by carding, wallet drainers, and pig-butchering ring management.

PhishDestroy's analysis of 342 million domains across 104 registrars ranks UltaHost the #3 worst registrar in the world (risk score 68/100):

• ● 728 flagged phishing domains (up from 422)
• ● 433 formal abuse reports filed
• ● 245 domains still alive (33.7% alive rate)
• ● 58% of reported domains remain active after formal complaints
• ● 98.4% confirmed malicious by VirusTotal

Four independent classifications now name UltaHost as bulletproof hosting:

• ● Bolster AI — anti-phishing cybersecurity firm
• ● HostAdvice — “8 Best Bulletproof Hosting Providers” (calls UltaHost “the best”)
• ● WebsitePlanet — “7 Best DMCA-Ignored Hosting”
• ● OnlyLoudest — UltaHost ranked #2

The 21-day cure period expires. UltaHost has not demonstrated compliance. The breach remains active. ICANN's next escalation steps could include suspension or termination of registrar accreditation, but ICANN chooses to allow more time.

ICANN's compliance division issues a formal Notice of Breach to UltaHost (IANA #4331) for violations of the Registrar Accreditation Agreement:

• ● RAA §3.18.2: failure to mitigate DNS abuse
• ● RAA §3.18.4: failure to provide abuse records
• ● RDAP non-compliance: no IPv6, conflicting version info
• ● Data escrow, contact info, and policy disclosure failures

UltaHost is given 21 days to cure the breach (deadline: 26 February 2025). This is one of only a very small number of such notices issued to any registrar in 2025.

DomainNameWire reports: “Ultahost signed its accreditation agreement in September and was assigned IANA#4331. As of the end of October, it had no .com registrations.” Their entire registrar business launched with zero legitimate .com customers — suggesting the registrar accreditation was sought to attract abuse-friendly business from the outset.