uniswap[.]poolv3[.]com

The domain uniswap.poolv3.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting Uniswap. Registration data shows the domain was created on 21 February 2026 through NiceNIC International Group Co., Limited and is served by Cloudflare nameservers igor.ns.cloudflare.com and jacqueline.ns.cloudflare.com. DNS resolution points to 172.67.137.155, an address owned by AS13335 Cloudflare, Inc. in the United States. The site presents an SSL certificate issued by Google Trust Services under the WE1 label, indicating use of Cloudflare’s universal TLS service. HTTP testing returns a 521 status with the page title "poolv3.com | 522: Connection timed out," suggesting the origin server is unreachable or deliberately refusing connections. VirusTotal scans have flagged the domain in 2 of 95 security vendor engines, and it is listed on at least one public blocklist, with PhishDestroy confirming it as blocked. Detected technologies include Cloudflare and HTTP/3, consistent with the observed infrastructure. The campaign is labeled as a crypto scam, though no payload or phishing page content has been publicly disclosed, leaving the specific attack vector uncertain. Defenders should immediately add uniswap.poolv3.com to DNS and web filtering policies, monitor for any resolve attempts to the associated IP, and enforce strict brand‑protective controls for Uniswap‑related traffic. Continuous scanning of the domain’s TLS certificate and HTTP responses is recommended to detect any changes that could indicate activation of a malicious front‑end.