v1-unid[.]top

Analysis of the domain v1-unid.top shows it is currently taken offline but retains evidence of a brand impersonation campaign targeting x.com. The domain was registered on December 06, 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑hosted address 172.67.202.198, an IP located in the United States and belonging to ASN 13335 (Cloudflare, Inc.). No SSL certificate is presented; HTTP requests return the default "Welcome to nginx!" page title, indicating the server is serving a generic Nginx landing page rather than a crafted phishing front end. The domain is listed on a single security blocklist and has been flagged by PhishDestroy.

Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. VirusTotal analysis recorded six detections out of ninety‑five scanning engines, confirming that multiple security vendors have identified malicious activity associated with the host. Nameserver delegation points to harlan.ns.cloudflare.com and lisa.ns.cloudflare.com, consistent with the Cloudflare infrastructure.

While the site is offline, the combination of recent registration, low trust score, blocklist inclusion, multiple vendor detections, and explicit attribution as a brand impersonation of x.com suggests a high likelihood that the domain was used to harvest credentials or lure users into fraudulent interactions. Defenders should continue to block the domain at perimeter filters, monitor the associated IP address for any future activation, and update threat intel feeds with the observed indicators. Organizations that rely on x.com should educate users about the absence of a legitimate SSL certificate and the generic nginx page title, and enforce multi‑factor authentication to mitigate credential compromise should any residual phishing attempts arise.