uniswap-base[.]org

This domain, uniswap-base.org, operates as a crypto drainer site designed to impersonate the legitimate Uniswap decentralized exchange platform. The site presents a fraudulent interface mimicking Uniswap’s trading environment, likely tricking users into connecting their cryptocurrency wallets to malicious smart contracts. Once connected, these contracts are engineered to execute unauthorized transactions, draining funds from victims’ wallets without consent. The page title, 'Buy, sell & trade Ethereum and other top tokens on Uniswap,' reinforces the deception by closely replicating the legitimate platform’s branding and user experience, increasing the likelihood of successful social engineering attacks against cryptocurrency holders.

Analysis of the domain’s infrastructure reveals multiple indicators of malicious intent. The domain was registered on May 31, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.76.201 and is flagged by 16 out of 95 security vendors on VirusTotal. Additionally, the domain appears on four security blocklists and is blocked by multiple threat intelligence platforms, including MetaMask and PhishDestroy. Google Safe Browsing has categorized the site under 'SOCIAL_ENGINEERING,' further confirming its role in fraudulent activity. The use of Cloudflare and HTTP/3 suggests an attempt to obscure the site’s true origin and evade detection, a common tactic in crypto drainer operations.

Users who have interacted with uniswap-base.org should take immediate action to mitigate potential financial losses. Disconnect any wallets previously linked to the site and revoke all associated smart contract permissions using a blockchain explorer or wallet management tool. Scan connected devices for malware, as crypto drainers often deploy additional payloads to harvest sensitive data. Monitor wallet activity for unauthorized transactions and report any suspicious activity to relevant blockchain analytics platforms. Given the high-risk nature of this domain, affected users are advised to transfer remaining funds to a new, secure wallet and avoid reusing credentials or private keys associated with the compromised interaction.