app-unlsvwap-v2[.]com

The domain app-unlsvwap-v2.com was registered on March 14, 2026 through NiceNIC International Group Co., Limited and resolved to the IP address 185.66.88.228, which belongs to Virtual Systems LLC (AS30860) in Ukraine. The site was served behind Cloudflare and used Nginx as the web server, while front‑end assets were delivered via third‑party CDNs including Unpkg, jsDelivr, cdnjs, and the crypto‑js library. A Let’s Encrypt R13 certificate was present, indicating an active TLS configuration at the time of analysis.

The authoritative nameservers were ns17.v-sys.org and ns18.v-sys.org. The page title returned by the server was "Uniswap Interface", matching the declared brand target of Uniswap and confirming the campaign’s intent to impersonate the legitimate Uniswap interface for a crypto‑related scam. VirusTotal scans recorded 2 detections out of 95 security vendors, and the domain appears on three public blocklists, specifically PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of malicious activity.

While the exact phishing page content has not been captured, the combination of brand impersonation, use of crypto‑js, and the designation as a crypto scam suggests the site likely attempted to harvest private keys or lure users into unauthorized token transactions. Defenders should block the domain and its resolved IP at perimeter and DNS levels, monitor traffic to the identified CDNs for anomalous requests, and update endpoint protection signatures to reflect the observed detections. Continuous observation of the associated nameservers and the registrar NiceNIC may reveal additional related domains, and threat‑intel feeds should be consulted for any future re‑use of the same infrastructure.