claimunite[.]to

Analysis of claimunite.to shows it was actively used to host a fraudulent UNITE airdrop page titled “UNITE Airdrop - Claim Your UNITE Tokens.” The site was registered on August 02 2025 through NameCheap, Inc. and resolves to the Amazon‑owned IP address 18.208.88.157, AS14618, located in the United States. No TLS certificate was deployed, indicating the service was delivered over plain HTTP. The domain appears on a single security blocklist and received a Gridinsoft trust score of 0 / 100, confirming a high confidence of malicious intent. PhishDestroy has already blocked the domain, and the page is associated with the “Airdrop Scam” phishing kit, a known template used to lure victims into submitting cryptocurrency wallet credentials.

VirusTotal reports that 1 of 95 scanning vendors flagged the domain, providing additional independent confirmation of its malicious nature. The nameservers dns1.p08.nsone.net through dns4.p08.nsone.net are consistent with the registrar’s configuration and do not appear to hide the hosting provider. Current intelligence indicates the site is taken offline, but the infrastructure – the registrar, hosting on Amazon AWS, and the observed kit – remains reusable for future campaigns.

Uncertainty remains regarding the full scope of victim impact because no public breach reports have been published. Defenders should continue to block claimunite.to at network perimeter, update intrusion detection signatures with the observed IP and nameserver set, and monitor for any re‑registration attempts or similar airdrop‑related payloads. Additional vigilance is advised for any communications referencing UNITE tokens, as the scam may reappear under a different domain while reusing the same social engineering narrative.