unldcoin[.]vip

This domain, unldcoin.vip, is identified as a high-risk phishing infrastructure specifically designed to impersonate cryptocurrency wallet services. Analysis indicates the site is engineered to harvest user credentials, private keys, and digital assets through deceptive interfaces mimicking legitimate wallet platforms. The domain is currently offline, though prior activity suggests it was actively targeting users in the cryptocurrency ecosystem. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered through Gname.com Pte. Ltd. on March 02, 2026, and resolves to the IP address 47.79.230.220. It appears on three security blocklists and is flagged by 12 of 95 vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100. Detected technologies include Vue.js for dynamic front-end rendering, Nginx as the web server, and Tencent Waterproof Wall, a security module often associated with hosting environments in specific regions. The presence of HTTP/3 and HSTS suggests an attempt to appear legitimate while maintaining operational security. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the threat remains relevant as similar domains may re-emerge under different names or IPs. Users and organizations are advised to block the domain and its associated IP at the network level, monitor for related phishing campaigns, and verify wallet addresses through official channels before transactions. Cryptocurrency holders should enable hardware-based authentication and avoid interacting with unsolicited wallet-related communications or websites.