uni-protocol-v3[.]app

On July 24, 2026, the domain uni-protocol-v3.app was observed as an offline endpoint associated with a generic phishing campaign. The authoritative page title returned by the server reads “Хостинг VPS в Германии, выделенные серверы - Надежный хостинг в Европе! | FORNEX”, indicating that the domain was serving content unrelated to the alleged phishing lure, a common tactic to evade analysis. The site resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is physically located in the United States. DNS resolution is handled by the Cloudflare nameservers benedict.ns.cloudflare.com and pola.ns.cloudflare.com, confirming that the domain was provisioned through the Cloudflare registrar.

Security controls have flagged the domain on a single blocklist and it was actively blocked by the PhishDestroy service. The Gridinsoft trust scoring system assigned a score of 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis recorded 2 detections out of 95 scanned vendors, reinforcing the malicious classification despite the limited number of positive reports. No TLS certificate was presented for the host, leaving the connection unencrypted and further indicating a lack of legitimate service. Safe Browsing checks have not returned a positive rating, which aligns with the offline status and the limited detection footprint.

Because the domain is currently taken offline, live content cannot be examined, and the precise phishing vector remains uncertain. However, the combination of a mismatched page title, low trust score, blocklist presence, and multiple vendor detections provides sufficient evidence for security teams to treat the domain as malicious. The registration via Cloudflare, combined with the use of generic sub‑domain naming, is consistent with prior observations of threat actors exploiting cloud providers to rapidly spin up disposable phishing infrastructure.