uniswap-app[.]at

The domain uniswap-app.at is a confirmed phishing site engaged in brand impersonation targeting Uniswap, a leading decentralized cryptocurrency exchange. It presents itself as the legitimate Uniswap platform to deceive users into interacting with fraudulent interfaces, posing an elevated risk of financial loss through cryptocurrency scams. No drainer kit was identified, but the site was actively used for cryptocurrency-related fraud before being taken offline.

Technical analysis shows uniswap-app.at was flagged by 2 of 95 VirusTotal security vendors, including Gridinsoft and SOCRadar, with a Gridinsoft trust score of 0/100. The domain was registered through Dynadot LLC and resolved to the IP address 104.21.82.204, hosted on Cloudflare’s network (AS13335) in the US. It appeared on 2 security blocklists, PhishDestroy and ScamSniffer, and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Uniswap | Trade Crypto on DeFi’s Leading Exchange,' and detected technologies included HSTS, Cloudflare Browser Insights, and HTTP/3. Nameservers were bella.ns.cloudflare.com and julian.ns.cloudflare.com.

Users who interacted with uniswap-app.at should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. Enable two-factor authentication on all cryptocurrency and financial accounts, and monitor for unauthorized transactions. Report the phishing domain to Uniswap’s official security team, as well as to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.