app-uniswap444[.]com

This domain, app-uniswap444.com, is actively engaged in brand impersonation targeting Uniswap, a decentralized finance protocol. Analysis indicates the site mimics legitimate Uniswap interfaces to deceive users into disclosing sensitive credentials or transferring cryptocurrency assets. The domain exhibits characteristics consistent with phishing infrastructure, including the use of a lookalike naming convention and deployment on a content delivery network to obscure hosting origins. No specific drainer kit signatures have been confirmed at this time, though behavioral patterns align with known cryptocurrency phishing campaigns.

Infrastructure analysis reveals the domain was registered on June 01, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 104.21.43.236, hosted on AS13335 Cloudflare, Inc., which is commonly leveraged to mask malicious infrastructure. VirusTotal reports 7 out of 95 security vendors have flagged the domain as malicious, while it appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. No detections were recorded in Google Safe Browsing at the time of assessment.

The domain remains active and poses a high risk to users, particularly those interacting with decentralized finance platforms. Immediate response actions include blocking the domain at the DNS level, implementing network-level filtering for the associated IP, and disseminating indicators of compromise to threat intelligence platforms. Despite these measures, the domain’s continued operation on a content delivery network complicates takedown efforts. Users are advised to verify domain authenticity through official channels, enable multi-factor authentication, and exercise caution when interacting with unsolicited links or prompts requesting cryptocurrency transactions. Organizations should monitor for related infrastructure, as this campaign may expand to additional lookalike domains or IP ranges.