rewards-unipeg[.]art

Analysis of rewards-unipeg.art indicates it is an active crypto drainer phishing domain, currently unresolved as of July 12, 2026. The domain was registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and is hosted behind Cloudflare (IP 104.21.10.5, AS13335, Canada). It returns an HTTP 301 redirect, suggesting an attempt to forward visitors to malicious endpoints. The page title, 'Unipeg // $UPEG,' aligns with cryptocurrency-themed lures, though no specific brand impersonation is confirmed beyond the scam type classification. Security vendors have flagged the domain on four blocklists, including PhishDestroy, MetaMask, SEAL, and ScamSniffer. AlienVault OTX records the domain in two threat intelligence pulses, reinforcing its association with malicious activity. Two of 91 security vendors on VirusTotal detect the domain as malicious, though this does not preclude undetected threats. The site employs Cloudflare CDN, jsDelivr for content delivery, and crypto-js, which may facilitate obfuscation or cryptographic operations typical of drainer kits. Defenders should treat this domain as high-risk. Block resolution at the DNS level and monitor for connections to 104.21.10.5. Given the 301 redirect behavior, inspect downstream URLs for further compromise. No evidence suggests takedown or mitigation as of this report.