unisrt[.]top

The domain unisrt.top was registered on November 24, 2025 through NiceNIC International Group Co., Limited and is currently listed as offline. Infrastructure analysis shows that the domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative name servers are Cloudflare‑provided (harlan.ns.cloudflare.com and lisa.ns.cloudflare.com). No TLS certificate is presented, and the HTTP response delivers the default "Welcome to nginx!" page, indicating that no overt phishing content was observed before the takedown.

The domain is flagged on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal reports that four of ninety‑five scanning vendors have marked the domain as malicious, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The recorded scam type is brand impersonation targeting the x.com brand, which aligns with the threat actor’s intent to misuse the brand’s reputation.

Evidence gaps include the lack of a captured malicious payload or login page and the absence of any SSL configuration, making it unclear whether the domain ever served a functional phishing landing page before removal. Defenders should immediately add unisrt.top to network and email deny lists, monitor Cloudflare‑owned IP ranges for similar registrations, and enforce strict outbound filtering for any traffic to newly created domains that resolve to Cloudflare infrastructure without TLS. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related aliases, and incident response teams should be prepared to investigate any future attempts that reference the x.com brand from similar infrastructure.