Análisis de phishing y seguridad de uni-protocol-v4.app

Analysis of the domain uni-protocol-v4.app, observed on July 24, 2026, indicates that it is currently offline but was previously identified as a generic phishing host. The domain resolves to the IPv6 address 2606:4700:3036::6815:11d4, which is owned by Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration was performed through Cloudflare, and the authoritative nameservers are opal.ns.cloudflare.com and watson.ns.cloudflare.com. No TLS certificate was presented, confirming the absence of HTTPS support at the time of capture. The HTTP response returned a simple directory listing with the page title "Index of /," providing no further context about the content served.

Reputation data shows the domain appears on one security blocklist and is explicitly blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in the domain's legitimacy. VirusTotal scans reported three detections out of ninety‑five security vendors, corroborating the malicious classification. No additional intelligence such as an associated malware kit, targeted brand, or campaign identifiers were available.

Given the observable indicators—cloud‑based hosting, lack of SSL, low trust score, blocklist presence, and multiple vendor detections—security teams should treat the domain as hostile. Recommended mitigations include adding the domain and its resolving IP address to outbound blocklists, monitoring for any future re‑registration or activity, and employing threat‑intel feeds that reference the current blocklist and PhishDestroy entries. Continuous observation is advised because the domain may reactivate under a different sub‑domain or hosting configuration, and its infrastructure shares characteristics common to other phishing operations hosted on Cloudflare's network.