unlswap-v3[.]im

Analysis of unlswap-v3.im, observed on July 25, 2026, indicates that the domain is currently offline but was previously identified as a crypto‑focused phishing operation. The domain resolves to IP address 188.114.97.3, which is assigned to AS13335 owned by Cloudflare, Inc., placing the hosting infrastructure within the United States. Registration was performed through Cloudflare, Inc., and the authoritative name servers listed are jaime.ns.cloudflare.com and paislee.ns.cloudflare.com. No SSL certificate is associated with the domain, meaning it did not serve content over HTTPS.

VirusTotal records show that six of ninety‑five security vendors flagged the domain, providing independent confirmation of malicious intent. The site appears on a single security blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of high risk. The threat classification in the intelligence set identifies the activity as a crypto scam, aligning with the observed infrastructure pattern of rapid deployment and takedown typical of phishing campaigns targeting cryptocurrency users.

Defenders should continue to block the domain name and its resolving IP address at perimeter defenses, add the associated Cloudflare name servers to blocklists, and monitor for any re‑registration or resurrection of the domain. Given the elevated risk rating, security teams are advised to include unlswap-v3.im in threat‑intel feeds, enforce URL filtering policies, and educate end‑users about unsolicited cryptocurrency requests that may reference similar domains. Continuous observation of the IP space and Cloudflare‑hosted assets is recommended to detect potential replication of the phishing infrastructure.