uni-stocks[.]xyz

The domain uni-stocks.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to 172.67.179.22, an address owned by Cloudflare, Inc. (AS13335) located in the United States. Both authoritative name servers are Cloudflare‑provided (malcolm.ns.cloudflare.com and sydney.ns.cloudflare.com), and the site is delivered via Cloudflare’s edge network, as indicated by the presence of HTTP/3 and enforced HSTS. The TLS certificate is issued by Google Trust Services under the WE1 label, providing a publicly trusted chain despite the malicious reputation.

VirusTotal records show six of ninety‑three scanners flagging the domain as malicious, and PhishDestroy has listed it as blocked. The domain also appears on one additional security blocklist. The page title returned when the site was online reads “Suspected phishing site | Cloudflare”, a standard warning page shown when Cloudflare disables a site for abuse. Current status is offline, so no live content can be examined; consequently, details about the specific phishing payload, targeted brand, or user‑interaction mechanisms remain unknown.

Defenders should continue to deny HTTP/S traffic to the IP address when the SNI matches uni‑stocks.xyz, add the domain to URL filtering and host‑based blocklists, and monitor for any re‑registration or reuse of the same registrar or Cloudflare name‑servers. Because the certificate is valid, security controls should not rely on TLS trust alone but should incorporate the six vendor detections and blocklist entries as risk indicators. Ongoing observation of the IP range and rapid response to any re‑appearance will help mitigate potential re‑use of this infrastructure.