unipegv4[.]com

This domain is flagged as a high-risk crypto drainer phishing site, designed to execute unauthorized transactions by draining cryptocurrency wallets of victims lured into interacting with fraudulent smart contracts. The page impersonates Unipeg ($UPEG), a legitimate token project, to deceive users into connecting their wallets under the pretense of claiming rewards, staking, or airdrops. Analysis indicates the site employs malicious JavaScript payloads to trigger signature requests that facilitate fund exfiltration upon user confirmation. Infrastructure analysis reveals the domain unipegv4.com was registered on May 2, 2024, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. The site resolves to the IP address 188.114.96.3 and utilizes a Let's Encrypt SSL certificate, providing a superficial layer of legitimacy. Detection metrics show 13 out of 95 security vendors on VirusTotal flag the domain as malicious, while independent trust scoring systems assign a 0/100 trust score. The domain appears on four security blocklists, including those maintained by wallet security providers and anti-fraud organizations, further corroborating its malicious classification. Mitigation against this crypto drainer threat requires immediate action from both end users and network defenders. Users are advised to revoke any connected wallet permissions associated with unipegv4.com using blockchain explorer tools and to monitor transaction histories for unauthorized activity. Network-level protections should include DNS filtering to block resolution of the domain and IP address, as well as endpoint detection rules to identify and prevent execution of the malicious JavaScript payloads. Organizations managing token-related infrastructure are recommended to proactively monitor for impersonation attempts and issue public warnings to their user base regarding fraudulent domains.