uniswap-exchange[.]click

Analysis of uniswap-exchange.click indicates a credential‑harvesting site targeting users of the Uniswap decentralized exchange. The domain resolves to the IPv4 address 190.2.145.38, which is announced by AS49981 belonging to WorldStream B.V. in the Netherlands. The hosting infrastructure is served by the DNS provider dnsowl.com, as evidenced by the authoritative nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. Registration data show the domain was created on 23 February 2025 and was registered through NameSilo, LLC. No TLS certificate is presented, leaving the site accessible only over HTTP, which is a common trait of low‑effort impersonation campaigns.

Reputation scoring from Gridinsoft assigns a trust value of 0 out of 100, indicating a high likelihood of malicious activity. VirusTotal scans have returned detections from 16 of 95 anti‑malware engines, reinforcing the suspicion. The domain is listed on two external blocklists and has been actively blocked by the PhishDestroy and Enkrypt filtering services. The page title was not captured in the available intelligence, so the exact content presented to victims remains unknown.

Given the current offline status, the infrastructure appears to have been taken down, but the observed indicators suggest a repeatable pattern that could be reused with a different domain. Defenders should add 190.2.145.38 to network‑level deny lists, monitor NameSilo‑registered domains that contain “uniswap‑exchange” or similar brand‑related keywords, and ensure that web‑filtering solutions continue to block the domain and its associated IP. Endpoint protection platforms should be updated with the VirusTotal detection signatures, and security operations teams should watch for similar brand‑impersonation domains that lack TLS and exhibit low trust scores. Ongoing vigilance is recommended to prevent future attempts at credential theft against Uniswap users.