uniz[.]top

The domain uniz.top was registered on 28 September 2025 through NiceNIC International Group Co., Limited. Its authoritative nameservers are coen.ns.cloudflare.com and tia.ns.cloudflare.com, indicating use of Cloudflare DNS. DNS resolution points to IP address 209.94.90.1, which belongs to AS40680 (Protocol Labs) and is geolocated in the United States. No TLS certificate is presented, so HTTP connections are unencrypted. The site is presently taken offline, and it has been listed by the PhishDestroy blocklist, as well as one additional security blocklist.

VirusTotal scans show that 12 out of 95 antivirus engines flagged the domain, suggesting malicious content. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the classification as unsafe. The page title returned by the server is “REWARD Portal v2 --- Latest Web3 Wallets”, and the domain is tagged as a wallet/seed phishing campaign that impersonates the Trust Wallet brand. AlienVault OTX includes the domain in a single threat‑intel pulse, providing further corroboration of its malicious intent.

The combination of brand impersonation, low trust scores, multiple vendor detections, and association with known phishing blocklists indicates an elevated risk profile. Defenders should block or sinkhole the domain at network perimeter, add the IP address 209.94.90.1 to deny lists, and monitor for any residual traffic. Endpoint security solutions should treat any payloads originating from this host as malicious, and users should be warned against entering cryptocurrency seed phrases on sites presenting the listed page title. Ongoing observation is advised to confirm whether the domain is re‑hosted or its infrastructure is reused in future campaigns.