nendfi[.]com

Analysis of nendfi.com shows a newly registered domain (created May 24, 2026) that resolves to the Cloudflare‑owned IP address 188.114.97.3 (AS13335). The domain is served through Cloudflare nameservers harlan.ns.cloudflare.com and lisa.ns.cloudflare.com, uses a Google Trust Services / WE1 SSL certificate, and presents HTTP/3 with Cloudflare Browser Insights. The page title returned by the server reads "Uniswap | Trade Crypto on DeFi’s Leading Exchange," directly matching the brand target Uniswap and indicating a brand‑impersonation attempt classified as a fake exchange. Infrastructure signals include a Gridinsoft trust score of 0/100, presence on three security blocklists, and detection by PhishDestroy, MetaMask, and SEAL. An AlienVault OTX pulse references the domain once, and VirusTotal reports 5 of 91 security vendors flagging it as malicious. The HTTP response code is 403, suggesting restricted access, but the presence of the brand‑specific title confirms the intent. While the exact content and user‑facing elements have not been examined, the convergence of brand‑targeted metadata, low trust scoring, and multiple blocklist entries provides strong evidence of active phishing activity. Defenders should immediately block nendfi.com at network and endpoint layers, add it to threat‑intelligence feeds, and monitor for any related C2 traffic or credential harvesting attempts linked to the Uniswap brand. Continuous re‑evaluation is advised in case the site changes its response or hosts additional malicious payloads.