unifier-protocol[.]info

Analysis of the domain unifier-protocol.info, observed on July 25, 2026, indicates a high‑confidence association with a cryptocurrency‑related phishing campaign. The domain was registered on March 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare infrastructure, resolving to IP address 104.21.37.109, which is geolocated to Canada and owned by Cloudflare, Inc. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E8) and employed security mechanisms such as HSTS and HTTP/3, but the presence of a zero‑score Gridinsoft trust rating (0/100) further underscores its malicious intent. The page title returned by the server – “Blockchain Node - Multiverse support” – aligns with the declared scam type of a crypto scam, suggesting the domain is used to impersonate blockchain support services. Technical fingerprinting shows the frontend built with React and jQuery, while Cloudflare Browser Insights and Cloudflare services are active, a configuration commonly observed in malicious hosting.

The domain appears on three independent blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing vector targeting cryptocurrency users. VirusTotal scans reported two detections out of ninety‑four scanners, providing additional corroboration of malicious activity. Current status is offline, indicating the operators may be rotating infrastructure or awaiting further exploitation cycles. Uncertainty remains regarding the exact payload delivered to victims, as the page content has not been publicly disclosed beyond the title.

Defensive recommendations include continued DNS‑level blocking of unifier-protocol.info, monitoring of associated Cloudflare IP ranges for similar activity, and inclusion of the domain in internal threat‑intel feeds.