uniswap[.]com[.]co

On July 24, 2026, the domain uniswap.com.co was observed as an offline infrastructure used for brand impersonation targeting Uniswap. The site presented the page title “Uniswap.com.co” and was built on a WordPress stack with MySQL, PHP, Bootstrap, LiteSpeed and modern JavaScript libraries, indicating a conventional web‑hosting approach. DNS resolution points to the IPv4 address 172.105.47.42, which belongs to AS63949 Akamai Connected Cloud located in India, and the domain is served through Cloudflare’s DNS service (kurt.ns.cloudflare.com, millie.ns.cloudflare.com). Registration data show the domain was created on December 20, 2024 and the registrar is Cloudflare, Inc. The TLS certificate is issued by Let’s Encrypt (R13), confirming the presence of HTTPS.

Reputation signals include a Gridinsoft trust score of 0 out of 100 and inclusion on one public security blocklist. AlienVault OTX references the domain in fifteen threat‑intelligence pulses, and PhishDestroy has listed it as blocked. VirusTotal scans returned fifteen positive detections out of ninety‑five antivirus engines, reinforcing the malicious classification. The domain is tagged as a “Crypto Scam” and explicitly impersonates the Uniswap brand.

Because the site is currently offline, active mitigation is limited to ensuring that any cached or lingering references are removed from internal allowlists and that endpoint detection rules flag any residual traffic to the IP address or domain. Defenders should continue to monitor the IP range of AS63949 for related activity, enforce blocklisting of the domain and its resolved IP in web filters, and update threat‑intel feeds with the observed indicators. Further analysis is pending to confirm whether the WordPress installation hosted phishing forms or additional malicious payloads, as the page content has not been captured.