account[.]unlimitedflavacustoms[.]com

Analysis of account.unlimitedflavacustoms.com indicates a credential‑phishing infrastructure that was taken offline as of the report date. The domain was registered through Tucows Domains Inc. on July 19 2025 and resolves to the Cloudflare‑owned address 23.227.38.74, which is associated with AS13335 in Canada. DNS is served by Google Domains name servers (ns‑cloud‑d1…‑d3.googledomains.com). The site presents the generic page title “Just a moment…”, returns HTTP 406, and is protected by a Let’s Encrypt E8 certificate, while HSTS and HTTP/3 are enabled.

Technology fingerprints reveal a Shopify front‑end built on Ruby, Ruby on Rails and React, suggesting a typical e‑commerce template that may be repurposed for credential collection. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming external detection of malicious use. Scamadviser assigns a trust score of 40 / 100, reflecting a low reputation. VirusTotal records show the domain was scanned by 95 vendors with no detections, but the lack of a flag does not constitute assurance of legitimacy.

Current evidence does not disclose the exact landing page content beyond the title, nor the targeted brand or credential fields, leaving the specific phishing vector uncertain. Defenders should add the domain and its IP address to network‑level blocklists, enforce TLS inspection for traffic to Cloudflare‑served hosts, and monitor for any residual redirects or sub‑domains that may be re‑used. Continuous hunting for Shopify‑based credential‑phishing patterns and reviewing logs for HTTP 406 responses from this host can help identify remnants of the campaign. Because the infrastructure leverages widely used services, further observation of related Cloudflare‑origin IPs is advisable to catch potential re‑deployment.