app[.]uniswap-distrbution[.]org

Analysis of app.uniswap-distrbution.org shows a newly created domain that was registered on February 21, 2026 and subsequently resolved to the Cloudflare address 104.21.64.1, an IP located in the United States and announced under ASN 13335 (Cloudflare, Inc.). The site presented a page title of "Uniswap | Trade crypto and NFTs safely on the top DeFi platform," yet the intelligence indicates the domain was used to impersonate the Aave brand, matching the declared threat type of brand impersonation. The domain’s TLS certificate, identified as WE1, was observed but no further validation details were disclosed.

Reputation scoring from Gridinsoft assigned a trust rating of 0 out of 100, suggesting a high likelihood of malicious intent. The domain has been listed on two external blocklists and was actively blocked by PhishDestroy and ScamSniffer, confirming that defensive feeds have already taken mitigation steps. VirusTotal scans reported that three of ninety‑five security vendors flagged the domain, providing additional independent confirmation of suspicious activity.

Current infrastructure status is offline, indicating that the hosting service has taken the site down or the operators have ceased activity. Defensive practitioners should continue to enforce blocklist rules for the IP 104.21.64.1 and the host name, monitor for any reappearance of similar sub‑domains under the same registrar, and consider pre‑emptive DNS sink‑holing for future resolutions. Ongoing observation of Cloudflare‑hosted assets targeting the Aave brand is advised, as the combination of a reputable CDN with a low trust score and brand‑specific impersonation is a pattern frequently leveraged in credential‑harvesting campaigns.