derivetiva[.]com

This domain is flagged as an elevated-risk Ethereum brand impersonation phishing site targeting cryptocurrency users. Analysis indicates the domain was designed to mimic legitimate Ethereum-based platforms, specifically Uniswap, to harvest credentials or distribute malicious payloads. The threat type falls under brand impersonation with a focus on cryptocurrency fraud, a common tactic used to exploit users of decentralized finance (DeFi) services.

Infrastructure analysis reveals the domain derivetiva.com was registered on October 13, 2025, through Gname.com Pte. Ltd. It resolved to IP address 172.67.142.185, hosted on Cloudflare’s network (AS13335). The domain lacks an SSL certificate, increasing the likelihood of interception or tampering. Detection metrics show 14 out of 95 security vendors on VirusTotal flagged the domain as malicious. It appears on two security blocklists: PhishDestroy and PhishingDB. The page title, "Uniswap," further confirms its intent to impersonate a trusted DeFi platform.

Mitigation steps for this threat type include immediate blocking of the domain and associated IP at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to derivetiva.com and similar impersonation domains. Users should be educated on verifying domain authenticity before interacting with cryptocurrency platforms, particularly those involving wallet connections or token swaps. Monitoring for newly registered domains with similar naming patterns (e.g., misspellings of "Ethereum" or "Uniswap") can help preemptively identify related threats. If credentials were entered on this domain, affected users should revoke wallet permissions and transfer assets to a secure wallet immediately.