uniswapuuwllet[.]webflow[.]io

This domain, uniswapuuwllet.webflow.io, is flagged as a brand impersonation threat targeting Uniswap, a decentralized cryptocurrency exchange. Analysis indicates the site mimics the legitimate Uniswap wallet interface to deceive users into interacting with malicious smart contracts or disclosing sensitive credentials. The page title, "Ųniswap Ⱳallet@^ Your Ǥateway to Decentralized Trading," employs Unicode obfuscation to evade basic detection mechanisms, a common tactic in crypto-focused phishing campaigns.

Technical indicators confirm the domain's malicious intent. The domain is detected by 2 out of 95 security vendors on VirusTotal, with a registrar identified as Webflow. It resolves to the IP address 104.18.36.248, which is associated with Cloudflare’s infrastructure, a frequent choice for adversaries due to its anonymity and resilience. The SSL certificate is issued by Google Trust Services, adding a layer of legitimacy to the site. The domain appears on three security blocklists, including MetaMask and PhishDestroy, further validating its classification as a threat. No specific drainer kit was identified, but the infrastructure aligns with known crypto wallet impersonation schemes.

As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by hosting providers or security teams. However, residual risk remains, as adversaries often redeploy similar infrastructure under new domains or subdomains. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the legitimacy of any linked smart contracts. Organizations should update blocklists to include this domain and its associated indicators to prevent future exposure.