unisocks-nft[.]xyz

unisocks-nft.xyz is currently offline but historical data indicate it was used as a crypto‑drainer targeting NFT investors. The domain was registered on 21 February 2026 and immediately began serving a page titled “Nur einen Moment…”. The site employed a Cloudflare TLS Issuing ECC CA 1 certificate, masking the original hosting location behind the Cloudflare network. DNS resolution points to IP 104.21.48.1, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. Reputation services flag the domain as highly malicious: Scamadviser assigns a trust score of 1 / 100, Gridinsoft reports 0 / 100, and five of ninety‑five VirusTotal scanners returned positive detections.

The domain appears on at least one security blocklist and is listed in an AlienVault OTX pulse, confirming its inclusion in threat‑intel feeds. PhishDestroy has also blocked the domain. Although the exact payload delivered by the site is not publicly disclosed, the classification as an NFT scam combined with the “crypto drainer” label suggests it attempted to lure victims into approving wallet transactions that transfer cryptocurrency to attacker‑controlled addresses. Uncertainty remains regarding the specific smart‑contract or wallet addresses used, as well as any secondary infrastructure that may have been leveraged after the initial page load.

Defenders should immediately add 104.21.48.1 to outbound and inbound deny lists, enforce domain‑level blocking for unisocks-nft.xyz across DNS filters, and monitor for newly registered domains that reuse the “unisocks‑nft” keyword pattern. Continuous ingestion of OTX and blocklist updates is recommended, as well as periodic re‑scans of the IP address for emerging indicators. Logging of any attempted connections to the Cloudflare IP from internal assets can aid in detecting residual activity. Given the low trust scores and multiple vendor detections, the domain should be treated as a high‑confidence malicious indicator.