unlogger[.]icu

unlogger.icu is an active domain observed in a generic phishing campaign. The site returns an HTTP 301 redirect and presents the page title “Bloom Sniper”. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on an IP address (198.23.190.194) located in the United States, ASN 36352 (HostPapa). DNS resolution uses Cloudflare nameservers dalary.ns.cloudflare.com and fonzie.ns.cloudflare.com, and the service is delivered over Cloudflare with HTTP/3 support. The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid certificate chain. Four of ninety‑three VirusTotal scanners have flagged the domain, and it appears on a single public blocklist. The domain is also listed as blocked by the PhishDestroy feed. No additional content analysis is available; the exact phishing payload, target brand, or credential‑capture mechanism has not been publicly disclosed. Given the observed infrastructure and the presence on threat feeds, defenders should add 198.23.190.194 to network blocklists, enforce DNS filtering for unlogger.icu, and monitor for any new sub‑domains or redirects that may appear. Continuous re‑scanning with multi‑engine services is recommended to capture any evolving malicious components. Organizations should also consider sinkholing the domain’s IP range to disrupt potential command‑and‑control traffic.