Domain security and threat intelligence

unicore.limited

Name: unicore.limited — PhishDestroy evidence record
Published: 2026-02-26
License: https://creativecommons.org/licenses/by/4.0/

In short

PhishDestroy first recorded unicore.limited on 2026-02-26. Stored VirusTotal result: 4/89 engines flagged.

Review the evidence

Registrar: Atak Domain Bilgi Tekn…
Resolved IP: 104.21.6.9Cloudflare, Inc. · CDN
Registered: Sep 5, 2025
First observed: Feb 26, 2026

PhishDestroy assessment Critical

71/100

Evidence score

Availability Content unavailable Content was unavailable in the latest observation Observed Nov 2, 2026 · 22:20 UTCdns_cache

Risk signals

VirusTotal detections: 4/89

VirusTotal

4 / 89

engine detections

URLScan

Malicious

Page captures

open gallery

Domain age

423 days

registered 2025-09-05 according to RDAP · source data differ

Analysis

Domain summary

PhishDestroy first recorded unicore.limited on 2026-02-26. Stored VirusTotal result: 4/89 engines flagged. Risk: critical (71/100). Registrar: Atak Domain Bilgi Tekn…. Status: Content unavailable. Hosting: CLOUDFLARENET, US. Do not enter credentials or connect a wallet.

Critical

Status: Content unavailable
VirusTotal: 4 / 89
Scam type (automated label): Credential Phishing
Hosting: 104.21.6.9Cloudflare, Inc. · CDN
Registrar: Atak Domain Bilgi Tekn…
Registered: Sep 5, 2025
Page captures: 4

Page captures Source results Registration record

Recorded source summary

PhishDestroy stores a record for unicore.limited. Source observations are dated separately; missing checks do not establish safety.

A reviewed analysis is not available for this text revision. Consult the dated source records below.

Source evidenceVirusTotal 4 / 89 9 sources

VirusTotal

4 / 89 engine detections

Retrieved / checked: 2026-09-19 04:33:27 · as stored; legacy timezone not established

Open report

URLScan

Malicious

2025-09-12 13:11 UTC

Open report

URLScanOriginal source recordObserved: 2025-09-12 13:11:32 UTC15 fields

Observed: 2025-09-12T13:11:32Z · Retrieved: 2026-10-23T12:59:52Z

Report ID

01993e0d-5d09-71d9-a7cf-3798cf87e3a7

Final URL

https://unicore.limited/cdn-cgi/phish-bypass

HTTP response

400

IP address

104.21.6.9

Contacted IP addresses

104.21.6.9

Autonomous systems (ASN)

13335

Document hash

e999e13afc2c76a9b3523daa037814a97f9ad5310ee32c4dfe3b5d006a0ed73b

TLS session and certificate

Subject alternative names: unicore.limited
*.unicore.limited
Cipher: AES_128_GCM
Issuer: WE1
Subject: unicore.limited
Protocol: TLS 1.3
Valid until: 2025-12-04 23:32:37 UTC
Valid from: 2025-09-05 22:34:04 UTC

Domain age, days

187

Differs from the registration date in RDAP (2025-09-05), which gives 6 days on the scan date 2025-09-12. The two sources disagree; both values are kept as recorded.

Registered domain age, days

187

Differs from the registration date in RDAP (2025-09-05), which gives 6 days on the scan date 2025-09-12. The two sources disagree; both values are kept as recorded.

Certificate age, days

Certificate validity, days

Page requests

Provider verdicts

Engine verdict

Tags: urlscan-ml
urlscan-ml-60c5e22
Score: 73
Malicious: Yes

Overall verdict

Tags: phishing
Score: 100
Brands: trustwallet
Malicious: Yes
Categories: phishing

URLScan verdict

Tags: phishing
Score: 100
Brands: Trustwallet
Malicious: Yes
Categories: phishing

HTTP headers

Server: cloudflare
X-frame-options: SAMEORIGIN
Referrer-policy: same-origin

Original source fields · JSON

Uuid	01993e0d-5d09-71d9-a7cf-3798cf87e3a7
Final url	https://unicore.limited/cdn-cgi/phish-bypass
Status	400
Ip	104.21.6.9
Contacted IP addresses	[ "104.21.6.9" ]
Asns	[ "13335" ]
Document hash	e999e13afc2c76a9b3523daa037814a97f9ad5310ee32c4dfe3b5d006a0ed73b
Tls	{ "san": [ "unicore.limited", "*.unicore.limited" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "unicore.limited", "protocol": "TLS 1.3", "valid_to": "2025-12-04T23:32:37Z", "valid_from": "2025-09-05T22:34:04Z" }
Domain age days	187 Differs from the registration date in RDAP (2025-09-05), which gives 6 days on the scan date 2025-09-12. The two sources disagree; both values are kept as recorded.
Apex age days	187 Differs from the registration date in RDAP (2025-09-05), which gives 6 days on the scan date 2025-09-12. The two sources disagree; both values are kept as recorded.
Tls age days	6
Tls valid days	90
Requests	2
Provider verdicts	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 73, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "trustwallet" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Trustwallet" ], "malicious": true, "categories": [ "phishing" ] } }
HTTP headers	{ "server": "cloudflare", "x-frame-options": "SAMEORIGIN", "referrer-policy": "same-origin" }

Separate monitor record · 2026-07-29 02:52 UTC

Separate stored monitor snapshot; does not replace the primary report record or establish current availability.

record_source: domain_monitor.urlscan
uuid: 01993e0d-5d09-71d9-a7cf-3798cf87e3a7
report_url: https://urlscan.io/result/01993e0d-5d09-71d9-a7cf-3798cf87e3a7/
score: null
malicious: null
result_at: 2026-07-29T02:52:00Z
enriched_at: 2026-03-29T09:24:03Z
source_timestamps: {"urlscan_result_at":"2026-07-29 04:52:00","urlscan_enriched_at":"2026-03-29 11:24:03"}
timestamp_basis: Europe/Berlin, as used by the existing report; source timestamps are retained verbatim

URLQuery

checked — no detections recorded

2025-09-07 12:53 UTC

Open report

OTX

no community references

2026-03-01 06:34 UTC

Open report