nupuni[.]xyz

Analysis of nupuni.xyz, observed as offline as of July 24, 2026, indicates that the domain was created on June 16, 2026 and is currently pointing to the Cloudflare edge IP 104.21.11.44 (AS13335, United States). The authoritative name servers are lauryn.ns.cloudflare.com and leland.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare's CDN. The TLS certificate presented is a Let's Encrypt certificate issued to the domain (subject identifier YE1), which is typical for fast‑deployed malicious sites. The only visible page title returned before takedown was “Messenger”, suggesting an attempt to lure users into messaging‑related credential harvesting, although the page content has not been captured. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar that is frequently seen in malicious registrations.

Gridinsoft assigned a trust score of 0 out of 100, indicating an extremely low reputation. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that at least one anti‑phishing platform has taken remediation action. VirusTotal scans show that six of ninety‑one scanning engines flagged the domain, reinforcing the malicious classification despite the low detection count. Uncertainties remain regarding the exact phishing kit used, the target brand, and any payload delivery mechanisms, because no further page content or network traffic has been published. The short lifespan (creation less than six weeks before takedown) limits the amount of observable activity, and the use of Cloudflare obscures the true origin of the hosting server.

Defenders should immediately add nupuni.xyz to internal DNS blocklists and URL filtering policies. Because the domain resolves to a shared Cloudflare IP, blocking the IP address may affect legitimate services; instead, rule sets should target the specific domain name.