bafybeicuxqau7b67tj32zjppm5nmsa7oad2kttn6xzmks2dx3bmezbl5ky[.]ipfs[.]dweb[.]link

This domain, bafybeicuxqau7b67tj32zjppm5nmsa7oad2kttn6xzmks2dx3bmezbl5ky.ipfs.dweb.link, poses an elevated-risk brand impersonation threat targeting users of the Uniswap decentralized exchange platform. Analysis indicates the domain is designed to function as a crypto drainer, a malicious tool engineered to siphon cryptocurrency assets from victims' wallets by mimicking legitimate Uniswap interfaces. The page title, 'Uniswap Interface,' and the domain's structure, hosted on IPFS via the dweb.link gateway, are crafted to deceive users into believing they are interacting with the authentic Uniswap platform. Such impersonation tactics are commonly employed to exploit trust in well-known brands, leading to unauthorized transactions and irreversible asset loss. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain resolves to the IP address 209.94.90.3, located in the United States under AS40680 (Protocol Labs), a network frequently utilized for decentralized web hosting. The domain was registered on November 29, 2021, through CSC Corporate Domains, Inc., a registrar often associated with both legitimate and malicious registrations. Detection metrics further substantiate the threat: the domain appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal, indicating a consensus among cybersecurity entities regarding its malicious intent. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the risk, as such certificates are routinely used to lend a false sense of legitimacy to phishing domains. Users who have visited this domain or interacted with its content are advised to take immediate remedial actions to mitigate potential financial loss. First, disconnect any cryptocurrency wallets that may have been connected to the domain and revoke any suspicious smart contract approvals using a trusted blockchain explorer. Second, monitor wallet activity for unauthorized transactions and report any anomalies to the relevant blockchain network or wallet provider. Third, scan local devices for malware or unauthorized extensions that may have been installed during the interaction. Given the irreversible nature of cryptocurrency transactions, affected users should exercise heightened vigilance and consider consulting cybersecurity professionals for further assistance. The domain has since been taken offline, but similar threats may persist under different identifiers or infrastructure.