demo-8fc[.]pages[.]dev

Analysis of demo-8fc.pages.dev indicates a confirmed brand‑impersonation campaign targeting Uniswap. The domain was created on 18 August 2024 and is registered through Cloudflare, Inc., using the authoritative nameservers faye.ns.cloudflare.com and hank.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site employed an SSL certificate issued by Google Trust Services under the WE1 designation, demonstrating that legitimate TLS was obtained despite the malicious intent. HTTP requests return a 403 status code, and the page title captured during the brief observation reads “Uniswap | Trade crypto and NFTs safely on the top DeFi platform,” directly referencing the targeted brand.

Security‑vendor scanning on VirusTotal recorded 17 of 91 engines flagging the domain, and the site appears on a single security blocklist. Gridinsoft assigned a trust score of 0 out of 100, and PhishDestroy has already taken the domain offline. The combination of a low trust score, multiple vendor detections, and active blocklisting confirms that the infrastructure is deliberately crafted for credential‑harvesting or transaction‑redirection against Uniswap users. Uncertainty remains regarding the specific payload or phishing page content because the site was taken offline before a full content capture could be performed.

No evidence of additional infrastructure such as command‑and‑control servers, malware drops, or secondary domains was observed in the available data. Defenders should continue to monitor the associated IP address and Cloudflare‑owned name servers for any re‑use, enforce outbound filtering to block connections to 188.114.97.3, and update URL‑filtering and threat‑intel feeds with the observed indicators.