app-uniswsp[.]org

Analysis of the domain app-uniswsp.org indicates it was actively involved in a phishing campaign targeting university or academic credentials. The domain was registered on February 21, 2026, through an undisclosed registrar and resolved to the IP address 104.21.80.1, which is part of Cloudflare's network (AS13335) located in the United States. The use of Cloudflare infrastructure is consistent with tactics observed in phishing operations, where threat actors leverage content delivery networks to obscure hosting origins and evade takedown efforts. The domain was flagged by one security vendor on VirusTotal, with no additional context provided regarding the specific nature of the detection.

It also appeared on a single security blocklist, identified by PhishDestroy, further supporting its classification as a phishing threat. The SSL certificate associated with the domain, labeled WE1, does not provide additional attribution but confirms the use of encrypted traffic, a common technique to lend legitimacy to phishing pages. As of the report date, the domain has been taken offline, suggesting either a successful mitigation effort or voluntary cessation by the threat actor. However, the infrastructure remains a potential risk, particularly if the same IP or associated hosting provider is reused for future campaigns.

Defenders are advised to monitor for re-registration attempts or shifts to alternative domains with similar naming conventions, such as variations on 'uniswsp' or other academic-themed terms. Given the limited detection data, the exact content of the phishing page is not confirmed, but the domain name suggests an attempt to impersonate a university or institutional portal. Organizations in the education sector should review logs for connections to this domain or its associated IP and consider implementing proactive blocking of newly registered domains with similar patterns.