uniswap-app[.]to

This domain, uniswap-app.to, is actively impersonating Uniswap, a decentralized cryptocurrency exchange, as indicated by its page title 'Uniswap DEX | The world's leading decentralized exchange (DEX)' and confirmed brand target. Registered on December 4, 2025, through the Government of the Kingdom of Tonga, the domain resolves to IP address 213.209.129.68, hosted on AS208185 (Net Gate Telecom S.R.L.) in the Netherlands. Analysis of its infrastructure reveals the use of Nginx and OpenResty web server technologies, alongside Contentful for content management, which may facilitate rapid updates to deceptive content. The domain is flagged by 17 of 95 security vendors on VirusTotal, with detections from multiple threat intelligence sources, including 15 pulses on AlienVault OTX. It appears on five security blocklists and is actively blocked by at least five security tools, including PhishDestroy and Polkadot. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. Nameservers are hosted under cloudns.net and cloudns.com, a provider frequently observed in phishing infrastructure. Defenders should prioritize blocking this domain at the DNS and IP level, as well as monitoring for related certificates or subdomains. The domain's creation date, hosting provider, and detection profile align with known patterns of crypto scam operations targeting decentralized finance users. No evidence suggests this campaign is inactive, and further investigation into associated wallet addresses or transaction redirection endpoints is recommended.