Live Phishing Tracker: 374 UltaHost Domains Still Active
A categorized snapshot of phishing domains registered through UltaHost as of July 19, 2026. 374 of 871 flagged domains remain live — a 33.7% alive rate. 58% of formally reported domains still serve victims despite abuse reports being filed.
Last verified: May 17, 2026 against PhishDestroy registrar stats. We re-check monthly. For the full current list, see PhishDestroy's live UltaHost domain page.
How to read this page: Each card shows a phishing domain registered through UltaHost. LIVE means the domain was reachable at last verification. VT is the VirusTotal threat score from 70+ antivirus engines. A score of 5+ is high confidence; 15+ is overwhelming consensus.
Bank Impersonation (LIVE)
Web3 / Crypto Wallet Phishing (Drainer Sites)
Pig Butchering / Investment Fraud (LIVE)
Airdrop Scams (Fake Crypto Giveaways, LIVE)
Token Presale Scams (Fake ICO, LIVE)
Government Impersonation
Trading Platform Fraud (LIVE)
Wallet-drainer malware families detected on UltaHost domains
Counts are system-wide PhishDestroy detections. Each represents an automated tool that empties a victim's crypto wallet in one transaction:
Brands most heavily impersonated
At least 18 major brand names appear in phishing domains registered through UltaHost:
The domain that says the quiet part out loud: walletdrainer.site — registered through UltaHost, with the literal crime in the domain name itself. It stayed live for months of formal abuse reports and finally went offline (NXDOMAIN) only by our July 19, 2026re-check. UltaHost's abuse-gatekeeping pattern (Gmail reporters dismissed, trademark required) meant a domain whose entire reason for existing was to drain wallets stayed operational because no one with appropriate legal credentials had reported it.
Verify these are still live yourself
Pick any domain above. Check its current status across these independent sources:
- ● PhishDestroy UltaHost domain page — full live list, click any domain for the full report
- ● VirusTotal — paste the domain to see its current threat score
- ● AbuseIPDB — paste the resolved IP to see per-IP abuse reports
- ● abuse.ch URLhaus — search the domain to see malware-distribution history
- ● Spamhaus Reputation Checker — check whether the IP is on the SBL/BCL/XBL
- ● Google Safe Browsing reporter — also a way to file a takedown
Important: do NOT visit these domains in your normal browser. They are live malware. Use a sandboxed environment (browser isolation service, dedicated VM, or just read the screenshots on PhishDestroy).