sortedai[.]uk

Analysis indicates that the domain sortedai.uk was registered on May 07, 2026 through Cloudflare, Inc. The site presents a page titled “Sorted AI — AI Automation for Norwich Salons,” suggesting an attempt to masquerade as a legitimate AI service for salon operators. The domain is currently active, resolves to the IP address 104.21.5.142, and returns HTTP 200 responses. Its TLS certificate is issued by Let’s Encrypt (E7), and the authoritative nameservers are brynne.ns.cloudflare.com. and jaime.ns.cloudflare.com.

The hosting infrastructure is entirely provided by Cloudflare, as evidenced by the IP location in Canada and the use of Cloudflare‑managed nameservers. This arrangement offers rapid content delivery and obscures the true origin of the malicious host, complicating attribution. The certificate issuance date aligns with the domain creation, reinforcing the view that the site was launched shortly after registration.

Threat intelligence sources show that the domain has been flagged by 1 of 95 security vendors on VirusTotal, indicating at least one detection of malicious behavior. The site appears on three security blocklists and has been referenced in a single AlienVault OTX pulse. Additional blocklist providers such as PhishDestroy, MetaMask, and SEAL have explicitly blocked the domain, and Gridinsoft assigns a trust score of 0 out of 100. These indicators collectively raise the risk rating to high.

Defenders should add sortedai.uk to network and endpoint blocklists, enforce DNS filtering, and monitor for any outbound connections to the resolved IP. Continuous observation of Cloudflare‑associated IP ranges is advised, given the platform’s frequent use by threat actors. Incident response teams should treat any credential or session data submitted to this site as compromised and advise affected users to reset authentication material.