uniswap-auth[.]com

Analysis indicates that the domain uniswap-auth.com was registered on June 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolved to the Cloudflare IP address 172.67.164.45, which is associated with ASN 13335 in the United States. The domain is currently listed as offline. The TLS certificate presented by the site is issued by Google Trust Services under the WE1 intermediate, confirming that the connection would be encrypted if the site were reachable. DNS resolution uses the Cloudflare authoritative nameservers carrera.ns.cloudflare.com and trace.ns.cloudflare.com, and the service is known to support HTTP/3.

The page title returned from the site is the literal string “uniswap-auth.com”, providing no additional context beyond the domain name itself. Reputation data shows that the domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans have identified five detections out of ninety‑one AV engines, reinforcing the malicious classification. The Gridinsoft trust score for the host is 0 out of 100, indicating a lack of legitimacy.

The observed indicators collectively align with the reported scam type of brand impersonation targeting the Uniswap brand. Given the observed infrastructure, defenders should add the IP address 172.67.164.45 and the fully qualified domain name uniswap-auth.com to network‑level blocklists and to endpoint protection deny lists. Continuous monitoring of Cloudflare‑hosted domains that resolve to the same ASN and exhibit similar registration dates is recommended, as the attacker may reuse the hosting environment for additional impersonation campaigns. Incident response teams should also verify that any internal authentication flows referencing Uniswap do not accept credentials from this domain, and users should be warned that any login request originating from uniswap‑auth.com is unauthorized.