unievent[.]xyz

The domain unievent.xyz was registered on February 21, 2026. DNS resolution points to the IP address 104.21.7.20, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The host is currently taken offline, and the domain appears on a single public blocklist where it is flagged by PhishDestroy. VirusTotal has recorded 10 positive detections out of 93 scanned security vendors, indicating that a minority of scanners identified malicious behavior.

The TLS certificate presented for the site is labeled "WE1", but no further issuer or validity details are available. No page title, landing‑page content, or impersonated brand information has been disclosed, so the exact phishing lure remains unknown. The limited visibility suggests the infrastructure was likely used briefly and then abandoned, a pattern consistent with opportunistic phishing campaigns that rely on cloud‑based hosting to obscure attribution.

Defenders should continue to monitor DNS queries for the domain and the associated IP, enforce blocklist updates that include the PhishDestroy entry, and consider adding the IP to network‑level deny lists. Although the domain is offline, remnants of the campaign could resurface under different subdomains or new registrations that reuse the same hosting provider. Ongoing threat‑intel feeds and periodic re‑scans of the IP on VirusTotal or similar platforms are recommended to detect any resurgence.