uniswap-joy[.]vercel[.]app

This domain represents a sophisticated Ethereum wallet drainer phishing operation targeting cryptocurrency users through brand impersonation. The site mimics legitimate decentralized exchange interfaces to trick victims into connecting their wallets, where malicious smart contracts execute unauthorized token transfers. Infrastructure analysis reveals the domain specifically replicates transaction flows and visual elements of the targeted platform, creating a convincing facade for credential harvesting and asset theft. Evidence indicates this is a well-established phishing campaign with significant detection coverage. The domain uniswap-joy.vercel.app appears on 3 security blocklists and is flagged by 21 out of 95 security vendors on VirusTotal. Registered through Tucows Domains Inc. on February 21, 2026, the domain resolves to IP address 64.29.17.3 hosted on Amazon Web Services infrastructure (AS16509). The SSL certificate issued by Google Trust Services provides a false sense of security while the site maintains active phishing operations. Users who have visited this domain should immediately revoke all connected wallet permissions and transfer assets to new wallets. Any credentials or recovery phrases entered should be considered compromised. Affected parties should monitor all connected accounts for unauthorized transactions and report the incident to relevant cryptocurrency security teams. The domain's continued operation despite multiple blocklist inclusions suggests this campaign targets users who bypass security warnings, emphasizing the need for verification of all transaction requests and domain authenticity before wallet connections.