unirccwap[.]cc

This domain, unirccwap.cc, is flagged as a high-risk generic phishing threat targeting users of the UNI cryptocurrency token. Analysis indicates it impersonates a legitimate wallet interface to harvest login credentials, seed phrases, and private keys. The domain does not appear to be linked to a known drainer kit based on current intelligence, but its design mimics decentralized finance (DeFi) platforms to deceive victims into disclosing sensitive authentication details. Infrastructure analysis reveals the domain was registered on February 21, 2026, and resolves to the IP address 172.67.205.14, hosted on Cloudflare’s network (AS13335). It is detected by 17 out of 95 security vendors on VirusTotal, with a WE1-class SSL certificate indicating minimal encryption standards. The domain appears on three security blocklists and is currently not flagged by Google Safe Browsing (GSB) as of the latest scan. Registrar details remain undisclosed, but the use of Cloudflare suggests an attempt to obscure hosting origins and evade takedown efforts. As of the latest verification, unirccwap.cc has been taken offline, likely due to enforcement actions by security providers or hosting interventions. However, residual risk persists due to the potential reuse of infrastructure or registration of similar domains. Users who interacted with this domain should immediately revoke wallet permissions, transfer assets to a secure address, and monitor for unauthorized transactions. Organizations are advised to block the domain, its associated IP, and any derived indicators in perimeter security controls to prevent future access attempts.