uniswap-sol-data[.]web[.]app

The domain uniswap-sol-data.web.app is currently active and engaged in cryptocurrency drainer phishing, specifically impersonating the Ethereum ecosystem. This infrastructure presents itself as a legitimate portfolio tracker under the title "Uniswap | Portfolio Tracker," targeting users of decentralized finance platforms. Analysis indicates this is a high-risk threat designed to compromise wallet credentials and siphon digital assets through deceptive transaction prompts. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Google LLC’s Firebase hosting service. It resolves to the IP address 172.67.134.162, associated with Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services under the WR4 root. Detection metrics show minimal coverage, with only 1 of 95 security vendors on VirusTotal flagging this domain as malicious. The domain appears on a single blocklist, suggesting limited prior exposure or evasion of broader detection mechanisms. The page title and branding elements closely mimic legitimate Uniswap interfaces, increasing the likelihood of user deception. Current status confirms the domain remains operational and unmitigated. Organizations and individuals are advised to block resolution to 172.67.134.162 at the network level and update endpoint protection rules to include this domain. Users should be alerted to verify domain authenticity before interacting with any cryptocurrency-related services, particularly those requesting wallet connections or transaction signatures. Monitoring for similar Firebase-hosted domains with Ethereum or Uniswap branding is recommended to identify related phishing clusters.