leaderboarduniswaportfolio[.]app

Analysis of leaderboarduniswaportfolio.app shows an infrastructure that aligns with a crypto‑scam impersonating the Uniswap brand. The domain was registered on February 21, 2026 and currently resolves to IP address 104.21.80.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The SSL certificate presented is identified as WE1, indicating the site had a valid TLS layer at the time of observation. HTTP requests return a page titled “Just a moment…”, a generic placeholder that offers no substantive content for user interaction.

Reputation data indicate the domain appears on one security blocklist and was specifically blocked by PhishDestroy. VirusTotal scans report five of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious activity. The threat is classified as brand impersonation with a crypto‑scam motive, targeting users of the Uniswap platform. The risk level is elevated, and the site’s status is listed as offline, suggesting the operators have taken the domain down, possibly after detection.

Defenders should immediately add leaderboarduniswaportfolio.app to deny lists across DNS, web‑proxy, and endpoint protection solutions. Monitoring of any future resolution changes or re‑registration attempts is advised, as threat actors frequently reuse similar domains. Analysts should also consider correlating inbound traffic logs for connections to the Cloudflare IP range to uncover residual malicious activity, and ensure that users are reminded not to trust unsolicited links claiming to be Uniswap related, especially those that redirect to domains with similar naming patterns.