token-unich[.]app

The domain token-unich.app was registered on 20 November 2025 through NiceNIC International Group Co., Limited. DNS resolution points to IP 95.214.235.117, which is assigned to Virtual Systems LLC in Ukraine (AS30860). The authoritative nameservers ns13.v-sys.org and ns14.v-sys.org are consistent with the hosting provider. No TLS certificate is presented, and an HTTP request returns the literal title “Index of /”, indicating a bare directory listing rather than a crafted landing page.

Gridinsoft assigns a trust score of 0 out of 100, and the domain is currently listed on two public blocklists, having been blocked by PhishDestroy and ScamSniffer. VirusTotal analysis shows that ten of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious use. The threat classification is a generic phishing campaign identified as a crypto scam, and the risk level is marked as elevated. As of the report date (25 July 2026) the site is offline, which is typical for short‑lived phishing infrastructure.

The evidence confirms that the domain was used as part of a cryptocurrency‑focused credential‑harvesting operation, but the exact payload, targeted brands, or victim interaction flow remain unknown because the site content was not captured before takedown. Defenders should continue to block the associated IP address and the two nameservers, add token-unich.app to local deny lists, and monitor for any re‑registration or resurrection of the domain. Additional telemetry from sinkhole or passive DNS feeds may reveal whether the same hosting infrastructure is reused for other campaigns. Ongoing observation of the registrar’s recent registrations could also help anticipate future malicious domains.