uniswap-foundation[.]limited

The domain uniswap-foundation.limited is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting Uniswap. DNS resolution points to IP 188.114.97.3, which belongs to the Cloudflare network (AS13335). The domain is registered through Cloudflare, Inc., and its TLS certificate is issued by Google Trust Services under the WE1 profile. HTTP requests return status code 520, and the site is listed on at least one public blocklist. Threat intelligence sources report that the page title presented to visitors reads “Bitwarder | Bitwarder Giriş | Your One‑ Stop Design Solution | Bitwarder”, indicating possible reuse of a template unrelated to the Uniswap brand. Automated analysis identified a stack that includes Apple iCloud Mail, Node.js, Salesforce, Google Sign‑in, Amazon Web Services, Stripe, Express, and enforced HSTS. Six of ninety‑five VirusTotal scanners flagged the domain, and AlienVault OTX shows the indicator in twenty‑four recent pulses. PhishDestroy has already blocked the domain, yet it remains reachable. Defenders should add the domain and its resolving IP to web‑filter and firewall deny lists, monitor for any credential‑phishing payloads, and consider tightening email authentication for messages purporting to originate from Uniswap. Ongoing observation is advised because the exact content served to victims has not been captured, and additional malicious services could be deployed behind the same infrastructure.