unisocksfi[.]xyz

Analysis of unisocksfi.xyz, created on 21 February 2026 and currently taken offline, shows multiple indicators consistent with a phishing operation. The domain resolves to 104.21.53.184, an IP owned by Cloudflare, Inc. (AS13335) located in the United States. DNS resolution is handled by Cloudflare name servers malcolm.ns.cloudflare.com and sydney.ns.cloudflare.com, and the site served HTTP/3 over a TLS certificate issued by Google Trust Services under the WE1 brand, indicating use of Cloudflare’s SSL termination. The page title returned by the server, “Suspected phishing site | Cloudflare,” explicitly labels the content as phishing.

VirusTotal scans recorded five detections out of ninety‑three security vendors, and the domain is listed on a single public blocklist, specifically PhishDestroy. Additional technical markers include enforcement of HTTP Strict Transport Security (HSTS) and the presence of Cloudflare’s security headers, which are common in malicious phishing deployments that rely on reputable CDN infrastructure to evade reputation checks. The registrar information points to NiceNIC International Group Co., Limited, a registrar frequently observed in abuse reports.

While the offline status prevents direct observation of payload or credential‑collection pages, the combination of a phishing‑explicit page title, multiple vendor detections, blocklist inclusion, and Cloudflare‑based hosting strongly supports a phishing classification. Defenders should add the domain and its associated IP address to local blocklists, monitor for any resurgence of activity, and ensure that any residual traffic is redirected to safe‑browse warnings. Continuous observation of the IP range 104.21.53.0/24 for similar patterns is recommended, as Cloudflare infrastructure is often reused across unrelated campaigns.