unidcfi[.]top

Analysis of unidcfi.top shows a clear pattern of brand impersonation targeting x.com. The domain was registered on December 02, 2025 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. Both authoritative name servers, harlan.ns.cloudflare.com and lisa.ns.cloudflare.com, are Cloudflare‑managed, indicating the use of Cloudflare’s DNS and edge services. The site presents a default "Welcome to nginx!" page title and lacks an SSL/TLS certificate, exposing any traffic to clear‑text interception.

A Gridinsoft trust score of 0 out of 100 further underscores the malicious nature of the host. The domain appears on a single security blocklist and has been flagged by PhishDestroy as a brand impersonation threat. VirusTotal reports that 14 of 95 security vendors have identified the domain as malicious, reinforcing the suspicion. Current status is offline, suggesting the operator may have taken the site down after detection.

Defenders should continue to block the domain at network perimeters, enforce TLS inspection policies to prevent accidental clearance of unencrypted traffic, and monitor for any re‑registration attempts or DNS changes. Adding the IP 188.114.97.3 to threat intelligence feeds and correlating with other Cloudflare‑hosted assets can help identify related infrastructure. Continuous vigilance is advised, especially for users of the x.com brand, to mitigate potential credential harvesting or brand abuse.