cdn-unilabs[.]com

Analysis indicates that cdn-unilabs.com is currently flagged as a high‑risk generic phishing infrastructure. The domain was registered on 3 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare, as evidenced by the authoritative nameservers harlan.ns.cloudflare.com and lisa.ns.cloudflare.com and the resolved address 104.21.69.223 located in Canada. The site serves over HTTP/3 and presents a valid SSL certificate issued by Google Trust Services (WE1), which is typical for abuse of reputable certificate authorities to lend credibility. The HTTP response code 521 (“Web server is down”) suggests the origin server is unavailable, a pattern often used to hide malicious payloads while maintaining the domain’s reputation. Independent security engines have flagged the domain in three of ninety‑one VirusTotal scans, and the domain appears on three external blocklists. Reputation scoring from Gridinsoft assigns a zero‑point trust rating, reinforcing the malicious assessment. The domain is actively blocked by multiple anti‑phishing services, including PhishDestroy, MetaMask, and SEAL, confirming its involvement in phishing campaigns. While the exact phishing landing pages have not been observed, the combination of recent registration, low trust score, active blocklist presence, and confirmed phishing classification constitutes strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the associated IP and nameservers, and consider adding the domain to internal blocklists. Ongoing observation is advised to detect any changes in hosting or content that could affect mitigation strategies.