swap[.]zicodao[.]io

The domain swap.zicodao.io is confirmed to be a phishing site engaging in brand impersonation, specifically targeting Uniswap, a prominent decentralized cryptocurrency exchange. The site is currently offline, but prior analysis indicates it presented itself as a legitimate trading platform under the title 'Uniswap | Trade crypto,' designed to deceive users into interacting with malicious infrastructure. Analysis of this domain reveals multiple high-risk indicators. It was flagged by 17 out of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. The domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, and resolves to the IP address 185.110.51.215, hosted in Poland under AS47544 (IQ PL Sp. z o.o.). The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites. Additionally, the domain appears on three distinct security blocklists, and its infrastructure has been actively blocked by multiple detection frameworks. The current status of swap.zicodao.io is offline, reducing immediate risk to end-users. However, the technical indicators and historical activity suggest a deliberate attempt to exploit trust in the Uniswap brand. Organizations and individuals are advised to block this domain at the network level, monitor for related infrastructure, and educate users on recognizing brand impersonation tactics. Security teams should review logs for prior interactions with this domain and investigate any associated wallet addresses or transaction hashes for signs of compromise.