uncmode[.]xyz

This domain is flagged as a high-risk brand impersonation threat targeting cryptocurrency users through an airdrop scam. The page title "$UNC Airdrop Dashboard" suggests an attempt to deceive victims into believing they are interacting with a legitimate token distribution platform, likely exploiting the popularity of decentralized finance projects to harvest credentials or steal funds. Analysis indicates the domain uncmode.xyz was registered on April 15, 2026, through NAMECHEAP INC. It resolves to the IP address 76.76.21.21 and uses a Let's Encrypt SSL certificate for encryption. Detection metrics reveal minimal coverage, with only 1 out of 95 security vendors flagging the domain on VirusTotal. The domain appears on a single security blocklist, and its Gridinsoft trust score is 0/100. AlienVault OTX has recorded the domain in one threat intelligence pulse, further corroborating its malicious nature. Mitigation steps for this airdrop scam threat include blocking the domain at the DNS or network level, particularly for organizations handling cryptocurrency transactions. Security teams should monitor for connections to 76.76.21.21 and alert on any internal access attempts. End-users should be educated to verify airdrop legitimacy by cross-referencing official project channels and avoiding interactions with unsolicited token distribution pages. Cryptocurrency wallet providers are advised to flag this domain in transaction warnings to prevent accidental fund transfers.