app[.]uniswevr[.]com

Analysis of app.uniswevr.com, created on February 21, 2026 and hosted behind Cloudflare’s edge network (IP 172.67.216.151, AS13335, United States), shows a high‑risk generic phishing infrastructure. The domain resolves to Cloudflare’s HTTP/3‑enabled service and uses a Google Trust Services / WE1 TLS certificate, indicating legitimate‑looking encryption. The authoritative nameservers are coleman.ns.cloudflare.com and rayne.ns.cloudflare.com, confirming the use of Cloudflare’s DNS. VirusTotal has recorded two detections out of ninety‑one scanners, and the domain appears on a single security blocklist, evidencing that reputable threat‑intelligence feeds have flagged it.

PhishDestroy has actively blocked the host, reinforcing its classification as malicious. The page title returned from the server reads “Fast Lane Uniswap – Your Reliable Courier Service,” suggesting an attempt to lure victims by referencing the Uniswap brand and a courier service narrative, although the full page content has not been publicly disclosed. The registrar information points to NiceNIC International Group Co., Limited, a known bulk‑registration provider often leveraged by threat actors.

Current monitoring indicates the site remains active as of July 24, 2026. Defenders should add app.uniswevr.com to URL filtering and DNS blocklists, enforce TLS inspection to capture any credential submission, and consider sinkholing the resolved IP range if organizational policy permits. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure, and any observed traffic should be logged for forensic correlation.