unisocksfi[.]pages[.]dev

PhishDestroy has identified unisocksfi.pages.dev as a high-risk generic phishing domain that impersonates the Unisocks brand to deceive users into connecting their wallets or revealing sensitive information. The domain's name mimics the legitimate Unisocks project, suggesting an attempt to trick visitors into believing they are interacting with an official Unisocks interface. While no specific drainer kit has been confirmed, the threat type strongly indicates a crypto-focused phishing operation aimed at stealing funds or credentials.

Technical analysis reveals several red flags. VirusTotal reports that 2 out of 95 security vendors flag this domain as malicious, indicating low but concerning detection. The domain was registered on January 8, 2026, through Cloudflare, Inc., and resolves to IP address 188.114.96.3. Its SSL certificate is issued by Google Trust Services (WE1), which is common for legitimate sites but also used by phishers. The page title displays a "522: Connection timed out" error, which may be a temporary issue or an intentional tactic to evade analysis. The domain currently appears on 2 security blocklists and is not listed on Google Safe Browsing, meaning users relying solely on GSB may not be warned.

As of now, the domain remains active and accessible, posing an ongoing risk to users. PhishDestroy recommends that anyone encountering this domain avoid interacting with it entirely—do not connect wallets, enter passwords, or click any links. Users should verify the authenticity of any Unisocks-related communications through official channels. The risk level remains high due to the domain's active status and its potential to harvest sensitive data. Continued monitoring is advised, and users are encouraged to report any suspicious interactions to PhishDestroy for further analysis.