unis-wap[.]surge[.]sh

This domain unis-wap.surge.sh was registered on 2026-02-26 through the Surge.sh service and resolves to 138.197.235.123, an IP owned by DigitalOcean, LLC (AS14061) located in the United States. The site presents a page titled “Uniswap | Trade Crypto on DeFi’s Leading Exchange” and is classified as a crypto‑scam brand‑impersonation campaign targeting the Arbitrum ecosystem. The TLS certificate is issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA, confirming the use of a publicly trusted SSL. Infrastructure analysis detected the Sectigo technology stack and the domain is listed on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal records show six of ninety‑three scanners flagging the domain as malicious. HTTP response code is 200, indicating the site is actively serving content. The Gridinsoft trust score is 0/100, reinforcing the malicious assessment. Current intelligence does not include a detailed page‑content review beyond the title, so the exact phishing mechanics remain unverified. Defenders should add unis-wap.surge.sh to deny‑list rules, monitor DNS queries for the associated IP range, and enforce TLS inspection to intercept potential credential or wallet address capture. Continuous re‑scanning is recommended to capture any payload evolution.