uniswapuniswapusa[.]com

Analysis of the domain uniswapuniswapusa.com, which was taken offline as of the report date, shows a clear pattern of brand impersonation targeting Uniswap users. The site was registered on September 15, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on DigitalOcean infrastructure (AS14061) with the IP address 209.38.77.113 located in the United States. DNS resolution uses the standard DigitalOcean nameservers ns1.digitalocean.com and ns2.digitalocean.com. No SSL certificate is present, indicating that the site was served over plain HTTP.

The page title observed during the brief crawl reads “Uniswap | Trade Crypto on DeFi s Leading Exchange,” matching the brand target and supporting the classification as a wallet/seed phishing campaign. Security assessments show a Gridinsoft trust score of 0 out of 100, and the domain appears on two independent phishing blocklists, PhishDestroy and ScamSniffer. VirusTotal analysis reports that six of ninety‑five scanning engines flagged the domain, reinforcing the malicious assessment. The combination of a newly created domain, lack of encryption, low trust score, and multiple vendor detections suggests an active attempt to harvest cryptocurrency wallet credentials or seed phrases from unsuspecting victims.

Current evidence does not include a detailed payload or the specific phishing page content, so the exact data‑collection mechanism remains uncertain. Defenders should block the domain at network perimeter, add it to local blocklists, and monitor for any related infrastructure using the same IP or nameserver pair. Continuous observation of the hosting provider’s IP range for similar patterns is recommended, as well as periodic re‑scanning should the domain reappear. The absence of an SSL certificate and the offline status reduce immediate exposure, but the infrastructure footprint may be reused for future campaigns targeting Uniswap users.