unijoin-mixer2[.]vip

PhishDestroy identifies unijoin-mixer2.vip as an active generic phishing domain currently under investigation for potential credential theft and fraudulent transactions. The domain does not appear to mimic a specific brand but may leverage social engineering tactics to deceive users. No drainer kit artifacts have been confirmed, but the domain’s behavior aligns with known phishing infrastructure patterns. The SSL certificate, issued by Let’s Encrypt, suggests an attempt to appear legitimate, while the recent domain registration on March 29, 2026, indicates opportunistic deployment. The technical footprint of unijoin-mixer2.vip reveals minimal detections, with VirusTotal scoring 2/95, registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, and a static resolution to IP 188.114.97.3. The domain’s recent creation date and lack of inclusion in Google Safe Browsing (GSB) highlight its novelty, though this does not preclude future malicious activity. Investigation into blocklist coverage shows no entries, reinforcing the need for proactive monitoring and containment measures. As of this report, the domain remains active with an under_investigation status, prompting immediate defensive actions such as DNS sinkholing and IP blocking. While the current risk is classified as under_investigation, the absence of detections and recent registration window elevates the urgency for organizations to implement protective controls. Users are advised to avoid accessing the domain, report any observed activity, and validate transactions through verified channels to mitigate potential exposure.