urniswap-app[.]com

urniswap-app.com was observed resolving to the IP address 172.67.205.123, which belongs to Cloudflare’s AS13335 network located in the United States. The domain was registered on 17 November 2025 through NiceNIC International Group Co., Limited and is serviced by the Cloudflare authoritative nameservers gwen.ns.cloudflare.com and reese.ns.cloudflare.com. No TLS certificate was presented when the site was queried, and the HTTP response returned the page title “Sorry, the website has been stopped,” indicating that the host has been taken offline. The site was classified as a crypto‑scam that impersonates the Uniswap brand.

Analysis of public threat‑intel feeds shows that the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. The Gridinsoft trust scoring system assigned a score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal recorded 12 detections out of 95 scanned security vendors, reinforcing the suspicion of abuse. The lack of a valid SSL certificate, combined with the low trust score and multiple vendor detections, suggests that the infrastructure was deliberately provisioned to host fraudulent content before being shut down.

Current uncertainty includes the exact content that was served prior to takedown, the specific phishing kit or scripts employed, and any potential downstream infrastructure that may have been used for credential harvesting or fund diversion. Defenders are advised to add the domain and its associated IP address to local blocklists, monitor for any future re‑registration of the same name or similar variations, and ensure that endpoint protection solutions are updated to reflect the 12 vendor detections reported by VirusTotal. Continuous observation of Cloudflare‑hosted assets targeting the Uniswap brand is recommended, as threat actors frequently exploit reputable CDN services to obscure malicious hosting.