app-uniswvq[.]org

Analysis indicates that app-uniswvq.org was registered on 21 February 2026 and is currently offline. DNS resolution points to 172.67.195.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. The domain appears on two security blocklists—PhishDestroy and ScamSniffer—confirming its involvement in malicious campaigns.

A TLS certificate identified as WE1 is present, indicating that the site attempted to serve HTTPS traffic. VirusTotal records show that 7 out of 93 scanned engines flag the domain as malicious, reinforcing the blocklist findings. No public page title, brand targeting, or drop‑per kit details have been disclosed, leaving the exact payload or impersonated service uncertain.

Defenders should add the domain and its resolving IP to deny‑list or sinkhole configurations, enforce DNS filtering, and monitor for any future re‑registration or activation of the same IP range. Continued scrutiny of Cloudflare‑hosted infrastructure for similar naming patterns is advisable, as the threat actor appears to leverage shared hosting to rotate domains swiftly. Given the elevated risk rating, organizations ought to treat any inbound traffic from this domain as hostile and ensure that email security gateways reference both the blocklist entries and the VirusTotal reputation when assessing communications that reference app-uniswvq.org.