unting[.]art

The domain unting.art was registered on April 10, 2024 through NameCheap, Inc. and remains active as of the report date, July 24, 2026. DNS resolution points to IP address 192.178.155.103, which belongs to AS15169 Google LLC and is geolocated in the United States. Despite the IP being owned by Google, the domain does not present a valid SSL/TLS certificate, exposing any traffic to potential interception. The authoritative nameservers are demi.ns.cloudflare.com and jasper.ns.cloudflare.com, indicating Cloudflare DNS services are in use. HTTP requests to the site return a 302 redirect status, suggesting the domain forwards visitors to another location, though the final destination has not been disclosed.

The page title returned by the server is simply "Google," matching the declared brand target, and the threat classification is brand impersonation of Google. Security telemetry shows the domain appears on one blocklist and has been flagged by PhishDestroy. AlienVault OTX includes the domain in a single threat intelligence pulse, and VirusTotal scans have resulted in nine out of ninety‑three security vendors marking the domain as malicious. These detections collectively provide concrete evidence of abusive activity.

However, details about the content served after the redirect, the specific payload, or any credential‑harvesting mechanisms remain unknown. Defenders should immediately block DNS resolution to unting.art and any traffic to its associated IP address, add the domain to internal deny lists, and monitor for additional domains resolving to the same IP range. Because no TLS is offered, enforcing HTTPS‑only policies will also prevent insecure connections. Continuous monitoring of Cloudflare‑associated nameservers for new malicious entries is recommended, as is periodic review of blocklist updates and OTX pulse revisions for any emerging indicators tied to this infrastructure.