uniswap[.]ke951[.]com

uniswap.ke951.com was observed as part of a crypto‑scam campaign that impersonates the Uniswap platform. The domain was registered on March 10 2026 through eName Technology Co.,Ltd. and resolves to the IPv4 address 171.22.193.173, which belongs to ASN 140224 (Nebula Global LLC) and is geolocated in Hong Kong. No TLS certificate is presented, indicating the site is served over plain HTTP. DNS resolution is handled by the dnspod.net nameservers canteen.dnspod.net and celery.dnspod.net. The page title returned by the server is “uniswap.ke951.com”, matching the domain exactly and providing no additional context.

Security tooling has flagged the domain as malicious. Google Safe Browsing classifies it as social engineering, and three of ninety‑four VirusTotal scanners have raised detections. The site appears on three independent blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 / 100, reinforcing the high‑risk assessment. The phishing kit identified in association with the domain is an “Airdrop Scam” kit, commonly used to lure cryptocurrency users with promises of free token distributions.

At the time of analysis the domain was taken offline, limiting immediate exposure but preserving forensic artifacts. The lack of an SSL certificate prevents verification of any potential credential capture over encrypted channels, and the plain‑HTTP service could be used to serve malicious scripts or redirect victims to further payloads. The registrar information does not provide a direct attribution, and the short lifespan of the domain (created less than five months before detection) suggests a throwaway infrastructure typical of opportunistic crypto scams. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and incorporate the observed indicators—IP address 171.22.193.173, the two dnspod.