hyperunitfix[.]xyz

Analysis of hyperunitfix.xyz, observed on July 23, 2026, indicates a high‑risk crypto‑scam infrastructure targeting MetaMask users. The domain was created on 21 February 2026 and resolves to IP address 104.21.24.174, which is owned by AS13335 Cloudflare, Inc., located in the United States. The site presented the page title “Unit” and employed an SSL certificate identified as WE1. VirusTotal scanned the domain and 12 of 93 security engines flagged it as malicious.

Five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have listed the domain, confirming its classification as a crypto‑draining phishing site. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The HTTP service is currently offline, so real‑time content analysis is unavailable. No registrar details are present in the supplied intelligence, limiting attribution of the registration entity.

The use of Cloudflare’s CDN suggests the operators are leveraging a common edge network to hide the true hosting environment and improve resilience against takedown. Defenders should add hyperunitfix.xyz to deny‑list rules, enforce DNS‑based blocking, and monitor for additional domains that resolve to the same Cloudflare edge IP or use the WE1 certificate fingerprint. Correlation with other MetaMask‑impersonation campaigns may reveal shared phishing kit components or command‑and‑control infrastructure. Continuous re‑scanning on VirusTotal and periodic verification against the five blocklists are recommended to capture any re‑activation of the site.