unxc[.]network

Analysis of the domain unxc.network indicates it is an active credential phishing site targeting Web3 users. Registered on September 8, 2025, through Dynadot Inc, the domain currently resolves to 104.21.23.22, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The site employs a 301 HTTP redirect, a common technique to obscure the final phishing destination or evade automated crawlers. SSL encryption is provided by Let's Encrypt (YR1), which, while standard for legitimate sites, is routinely abused by threat actors to lend false credibility. The page title, 'Web3 Connect Demo,' suggests an attempt to mimic legitimate Web3 authentication interfaces, likely aiming to harvest cryptocurrency wallet credentials or private keys. This aligns with the classification of credential phishing, as noted in available threat intelligence. The domain is flagged by four security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious status. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, technologies that can enhance performance and resilience but are also leveraged by attackers to mask origin servers and complicate takedown efforts. Nameservers ns1.dyna-ns.net and ns2.dyna-ns.net are associated with the domain, though their historical use in other malicious campaigns is not confirmed in the available data. Defenders should treat unxc.network as an active threat. Network-level blocking of the IP 104.21.23.22 and domain-based filtering are recommended. Given the use of Cloudflare, additional monitoring for related domains or subdomains may be warranted. The exact content and functionality of the phishing page remain unanalyzed, but the combination of technical indicators and threat intelligence confirms its malicious intent. No legitimate use case for this domain has been identified.