unc-sol[.]com

This domain is flagged as an elevated-risk cryptocurrency airdrop scam targeting users with fraudulent UNC token claims. Analysis indicates the infrastructure was designed to deceive victims into connecting wallets or submitting sensitive credentials under the pretense of an exclusive airdrop distribution, a common tactic in blockchain-based financial fraud schemes.

Infrastructure analysis reveals the domain unc-sol.com was registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolved to the IP address 104.21.23.189 and employed technologies including HSTS, Cloudflare, and HTTP/3, likely to evade detection and enhance perceived legitimacy. The page title displayed "$UNC // AIRDROP CLAIM", directly referencing the fraudulent offer. The domain appears on three security blocklists and is flagged by 5 out of 95 security vendors on VirusTotal, with a trust score of 0/100. It has been blocked by multiple wallet protection and anti-phishing systems, including MetaMask and PhishDestroy, confirming its malicious classification. The domain is currently offline, though historical activity suggests potential for reactivation under similar infrastructure.

To mitigate risks associated with this type of threat, users should verify airdrop legitimacy through official project channels only. Wallet connections should never be authorized on unfamiliar domains, especially those not linked from verified social media or documentation. Security teams are advised to monitor for domains mimicking token names with "airdrop" or "claim" in the title, particularly those using Cloudflare or recently registered through high-risk registrars. Blocking the IP 104.21.23.189 and related infrastructure at the network level can prevent access to resurrected or cloned instances of this scam. Additionally, educating users on the prevalence of airdrop fraud and the importance of cross-checking URLs with official sources remains a critical defense measure.