unisocks-mrkt[.]xyz

unisocks-mrkt.xyz was registered through NiceNIC International Group Co., Limited on 21 February 2026. The domain resolves to 104.21.31.175, an address owned by AS13335 Cloudflare, Inc. in the United States. DNS is served by malcolm.ns.cloudflare.com and sydney.ns.cloudflare.com, and the site employed HSTS and HTTP/3 via Cloudflare’s edge network. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS configuration.

At the time of analysis (24 July 2026) the site was taken offline, and the page title returned by the server was “Suspected phishing site | Cloudflare”. VirusTotal recorded five detections out of ninety‑three scanning engines, indicating that multiple security vendors have flagged the domain as malicious. The domain appears on a single public blocklist and is specifically listed by PhishDestroy, confirming its classification as a phishing infrastructure. The available evidence does not include any payload samples, login page screenshots, or targeted brand information; therefore the exact phishing campaign details remain unknown.

The combination of a recent registration date, Cloudflare‑provided hosting, a valid Google‑issued certificate, and multiple vendor detections suggests a purposeful attempt to lend credibility to a fraudulent site before it was seized. Defenders should continue to block the domain at the network perimeter and DNS resolver level, monitor for any re‑registration attempts, and add the IP address 104.21.31.175 to threat‑intel feeds that track Cloudflare‑hosted malicious infrastructure. Ongoing observation of the associated nameservers and the PhishDestroy blocklist entry is recommended to detect any resurgence of activity.