uni-voucher[.]xyz

Analysis of uni-voucher.xyz indicates that the domain was registered on February 21, 2026 and subsequently pointed to the IP address 104.21.80.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented by the site is the Cloudflare TLS Issuing ECC CA 1, confirming the use of Cloudflare’s edge services for SSL termination. The domain has been taken offline, and the current HTTP status reflects that the site is no longer reachable.

Independent threat‑intelligence sources have already taken mitigation steps: PhishDestroy has listed the domain as blocked, and it appears on at least one public security blocklist. VirusTotal scans show that five of ninety‑three antivirus and URL‑reputation engines flagged the domain, providing additional corroboration of malicious intent. No additional data such as page title, registrar details, Safe Browsing status, OTX references, or further trust‑score metrics are available in the current intelligence set, leaving those aspects unverified.

Defenders should continue to enforce existing blocklist rules for the IP 104.21.80.1 and the domain name, monitor for any re‑hosting attempts that may arise from the same Cloudflare edge, and consider adding the domain to internal URL filtering policies. Given the confirmed registration date, Cloudflare hosting, and the observed detection by multiple security vendors, the domain should be treated as a confirmed phishing campaign indicator, and any inbound traffic to it should be denied or redirected to a safe‑browse warning page. Ongoing vigilance is advised to capture any future re‑activation or related domains that share the same hosting infrastructure.