uncx[.]org

PhishDestroy identifies UNCX.org as an active crypto drainer phishing domain under investigation, posing as the legitimate UNCX platform to deceive cryptocurrency users. This domain is designed to trick victims into connecting wallets or transferring funds, leveraging brand impersonation to exploit trust. The threat is currently classified as 'under_investigation' but remains active and dangerous to unsuspecting users.

This domain exhibits multiple red flags confirmed by threat intelligence data. UNCX.org was created on December 24, 2025, an unusually recent registration suggesting opportunistic malfeasance. It resolves to IP address 172.67.178.136 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting high-risk domains. The SSL certificate issued by Google Trust Services provides a false sense of security, while VirusTotal currently shows 3/95 detections—indicating it has evaded automated detection systems. The page title 'www.www.uncx.org' uses unusual subdomain repetition, a common obfuscation tactic used by phishing operators to mimic legitimate sites.

To mitigate risk from this crypto drainer scam, users must immediately cease all interactions with UNCX.org and any associated subdomains. Block the domain at the network level using DNS filters and update firewall rules to reject traffic to 172.67.178.136. Cryptocurrency users should verify URLs through official channels and use hardware wallets or transaction simulation tools before approving any transfers. Report this domain to threat intelligence platforms like VirusTotal, AbuseIPDB, and your local cybercrime unit. Organizations should add UNCX.org to blocklists and monitor internal DNS logs for repeated resolution attempts. Proactive blocking combined with user education is critical to preventing financial loss from this active crypto drainer.