unisocks-hub[.]xyz

Analysis of the domain unisocks-hub.xyz indicates a confirmed phishing campaign targeting Uniswap users, classified as brand impersonation. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and has since been taken offline as of the report date. Infrastructure analysis reveals the domain resolved to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), with nameservers malcolm.ns.cloudflare.com and sydney.ns.cloudflare.com. The SSL certificate was issued by Google Trust Services (WE1), and the site employed security technologies including HSTS and HTTP/3, which are consistent with Cloudflare-protected properties.

Detection data shows the domain appeared on one security blocklist, and 17 of 93 security vendors on VirusTotal flagged it as malicious. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its classification as a phishing endpoint. Gridinsoft assigned a trust score of 0/100, reinforcing the assessment of elevated risk. While the exact content of the phishing page remains unanalyzed, the available evidence—including the domain name, registration details, and detection metrics—strongly supports its role in a Uniswap-branded phishing operation.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network level. Historical logs should be reviewed for connections to 188.114.96.3 or interactions with the domain post-registration. Given the use of Cloudflare infrastructure, additional related domains may exist under the same nameservers or registrar; monitoring for newly registered domains with similar naming patterns (e.g., 'uniswap,' 'socks,' or 'hub') is recommended. No evidence suggests persistence beyond the reported takedown, but residual risk may remain if cached or archived versions of the site are accessible.