market-uni[.]xyz

This domain, market-uni.xyz, is flagged as a high-risk credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates no association with legitimate brands or known drainer kits, suggesting a generic phishing campaign designed to capture sensitive authentication details. The site employs no visible brand impersonation, relying instead on social engineering tactics to trick victims into submitting credentials or personal information. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.). It lacks an SSL certificate, increasing the risk of interception during data transmission. Security vendors on VirusTotal detect the domain at 17/95, and it appears on three independent security blocklists. Google Safe Browsing (GSB) has not yet classified the domain, but it is actively blocked by at least three major security platforms. The domain remains active and operational, posing an ongoing threat to users. Response actions include immediate blocking by security providers, though the absence of SSL and the recent creation date suggest a low-effort but potentially effective campaign. Remaining risks include the domain’s persistence, lack of encryption, and the potential for rapid redeployment under a new name. Users are advised to avoid interaction, verify URLs before inputting credentials, and report the domain to their security teams for further mitigation. Organizations should update blocklists and monitor for related infrastructure to prevent access.