www-app-uniewap[.]pro

PhishDestroy identifies www-app-uniewap.pro as a confirmed crypto drainer impersonating Uniswap, designed to trick users into connecting their wallets and authorize malicious transactions. This domain was flagged by Google Safe Browsing under SOCIAL_ENGINEERING and has been taken offline after being blocked by MetaMask and SEAL. Threat intelligence confirms it resolved to IP 104.21.30.14, was registered on May 02, 2026, and appeared on 2 security blocklists, with only 1 out of 95 VirusTotal security vendors detecting it at the time of analysis. This domain leveraged a Let’s Encrypt SSL certificate to appear legitimate while hosting a spoofed Uniswap interface aimed at draining cryptocurrency assets. The threat actor used NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, suggesting a lack of rigorous domain vetting. While currently offline, the domain may resurface under new infrastructure, emphasizing the need for continuous monitoring and user vigilance. Users who visited this domain should immediately disconnect any connected wallets, revoke any unauthorized token approvals via tools like revoke.cash, and scan their devices for malware. Report the domain to PhishDestroy and avoid interacting with any future iterations. Always verify URLs through trusted sources or PhishDestroy before entering credentials or approving transactions.