unijoin[.]me

PhishDestroy has identified a phishing campaign leveraging the domain unijoin.me to impersonate the Ethereum brand. The domain, registered through 1API GmbH, presents itself as "UniJoin - Home" and is designed to deceive users into believing they are interacting with a legitimate Ethereum-related service. No specific drainer kit has been identified, but the site's intent is clearly fraudulent.

Technical indicators paint a concerning picture: VirusTotal shows 0/95 detections, meaning the domain has not yet been flagged by security vendors. The domain resolves to IP 172.67.144.202, was created on November 26, 2024, and lacks SSL certificate. It appears on 3 security blocklists, indicating some recognition by threat intelligence platforms, but it is not currently blacklisted by Google Safe Browsing.

As of the latest check, the domain is offline, suggesting it may have been taken down or is temporarily inactive. However, the risk remains that the domain could be reactivated or that similar domains will appear. PhishDestroy recommends users avoid any interaction with unijoin.me and report any suspicious communications referencing this domain. Stay vigilant against Ethereum-related phishing attempts and always verify URLs before entering sensitive information.