uxento[.]net

uxento.net was observed with the page title “$GOAT”, a hallmark that has appeared in prior generic phishing operations. The domain was registered on 28 April 2025 through Tucows Domains Inc. and resolves to the Cloudflare‑managed address 104.21.66.113, ASN 13335, located in the United States. DNS resolution uses the Cloudflare nameservers bayan.ns.cloudflare.com and karina.ns.cloudflare.com, and the site served over HTTPS with a Google Trust Services / WE1 certificate, indicating a valid SSL chain issued by Google. HTTP traffic employed Cloudflare Browser Insights and HTTP/3, suggesting the infrastructure is fully hosted behind Cloudflare’s edge network.

Threat‑intel feeds have listed uxento.net on two blocklists—PhishDestroy and ScamSniffer—both of which currently flag the domain as malicious and have taken it offline. VirusTotal scanning recorded a single positive detection out of 95 antivirus engines, reinforcing the suspicion. No public entries were found on OTX or Google Safe Browsing at the time of analysis, but the presence on multiple blocklists and the single vendor alert provide sufficient evidence of malicious intent.

The combination of a recent registration, use of a reputable CDN to mask the origin, a legitimate‑looking SSL certificate, and a page title that aligns with known phishing lures indicates a purpose‑built phishing campaign. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address or associated Cloudflare nameservers, and update intrusion‑detection signatures to include the observed page title “$GOAT”. Ongoing vigilance is advised because the underlying hosting provider can quickly redeploy the same infrastructure under a new domain.