uniswapp[.]run

The domain uniswapp.run is currently classified as a high‑risk brand‑impersonation site targeting Uniswap. It was registered on March 12, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and immediately resolved to the Cloudflare‑owned address 104.21.95.4 (AS13335). The hosting environment presents Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support, indicating the use of Cloudflare’s edge network for traffic delivery. DNS resolution is managed by the nameservers adel.ns.cloudflare.com and jerome.ns.cloudflare.com, further confirming reliance on Cloudflare infrastructure.

The site presents a single HTTP response with status code 403 and a page title of "Just a moment...", which is the only observable content at the time of analysis. The TLS certificate is issued by Google Trust Services under the WE1 designation, providing a valid HTTPS connection but offering no indication of the underlying content. VirusTotal has flagged the domain by three out of ninety‑five scanned security vendors, and it appears on one external security blocklist. Independent monitoring by PhishDestroy has also blocked the domain, and the Gridinsoft trust score registers at 0 / 100, reflecting an extremely low confidence level in the domain’s legitimacy.

Analysis indicates that the infrastructure is purpose‑built for a cryptocurrency‑related scam, leveraging a trusted CDN to obscure the origin of the malicious payload and to evade simple IP‑based blocking. The limited visible evidence (page title and HTTP 403) prevents a full content assessment, so the exact phishing mechanics remain uncertain. Defenders should proactively block uniswapp.run at network borders, add the domain to URL filtering policies, and monitor for any related sub‑domains or DNS changes. Continuous re‑evaluation is advised, as threat actors may later deploy credential‑harvesting pages or malicious redirects behind the current Cloudflare‑protected front.