uniswapengine[.]limited

On 25 July 2026, the domain uniswapengine.limited was observed hosting a credential‑harvesting site that masquerades as Uniswap. The site resolved to the IPv4 address 172.67.130.219, which belongs to AS13335 Cloudflare, Inc., placing the hosting infrastructure behind Cloudflare’s edge network in the United States. Registration details show the domain was provisioned through Cloudflare, Inc., and the authoritative nameservers are eva.ns.cloudflare.com and sevki.ns.cloudflare.com, indicating the registrar did not expose direct ownership information. TLS termination is performed by Google Trust Services under the WE1 certificate, providing a valid HTTPS handshake but not mitigating the underlying malicious intent.

Dynamic analysis recorded three detections out of ninety‑five VirusTotal scanners, and the domain appears on a single external blocklist, which was also the source that initially blocked the site via PhishDestroy. Independent reputation scoring from Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high likelihood of abuse. The page title returned by the server – “Bitwarder | Bitwarder Giriş | Your One‑ Stop Design Solution | Bitwarder” – does not reference Uniswap, suggesting the content was either repurposed or the site was taken offline before detailed content capture could be performed. Detected backend technologies include Node.js, Express, Salesforce, Stripe, Amazon Web Services, Google Sign‑in, Apple iCloud Mail, and HTTP Strict Transport Security (HSTS), a stack commonly observed in commodity phishing kits.

At the time of reporting the service was offline, which limits immediate threat exposure but does not guarantee the infrastructure will not be reactivated. Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds with the observed indicator set, and monitor for re‑registration of the same second‑level domain or similar variations that point to the same Cloudflare IP range.