uqegs[.]app

This domain presents a targeted cryptocurrency phishing threat designed to deceive users into engaging with fraudulent token offerings. The site displays the page title 'Unipeg // $UPEG', suggesting an attempt to impersonate a legitimate cryptocurrency project or token distribution platform. Analysis indicates the domain is structured to harvest sensitive information, such as wallet credentials or private keys, under the guise of a new or exclusive token launch. The use of cryptocurrency-related branding increases the likelihood of successful social engineering, particularly against users familiar with decentralized finance (DeFi) or token airdrops. Technical indicators confirm the malicious nature of this domain. The domain uqegs.app is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and was created on May 27, 2026, a date that may be anomalous or indicative of domain spoofing. It currently resolves to the IP address 172.67.128.231 and is detected by 17 out of 95 security vendors on VirusTotal. The domain appears on four distinct security blocklists and is actively blocked by multiple cryptocurrency security tools. Infrastructure analysis reveals the use of Cloudflare for hosting and DDoS protection, along with modern web technologies including Vue.js, HSTS, and HTTP/3, which may be employed to enhance the site’s perceived legitimacy and evade detection. Users who have visited uqegs.app or interacted with its content should take immediate remediation steps. Any credentials, wallet addresses, or private keys entered on the site should be considered compromised. Users are advised to revoke access to any connected wallets or smart contracts, monitor for unauthorized transactions, and rotate passwords or seed phrases associated with affected accounts. Additionally, affected systems should be scanned for malware or unauthorized extensions, particularly those targeting browser-based cryptocurrency interactions. The domain’s active status and ongoing detection by security tools indicate it remains a viable threat, and users should avoid all interaction with it.