mail[.]uniswap-trade[.]net

mail.uniswap-trade.net was observed by multiple security sources as a brand‑impersonation site targeting Uniswap users. The domain was registered through Dynadot LLC on 18 October 2025 and resolves to the IPv4 address 192.250.229.83, which is assigned to AS209341 (WHG Hosting Services Ltd) in Germany. DNS resolution returns four authoritative name servers – ns1.mysecurecloudhost.com, ns2.mysecurecloudhost.com, ns3.mysecurecloudhost.com and an incomplete entry “ns” – all under the same hosting provider. No TLS certificate is presented, indicating the site operates only over HTTP.

The page title reported by scanners is “1 new message”, and the site is classified as a crypto‑scam that impersonates the Uniswap brand. VirusTotal has recorded 13 detections out of 95 scanned engines, confirming malicious intent. The domain appears on one external blocklist and is specifically listed by PhishDestroy as an offline phishing artifact. Because the site is currently taken offline, live content cannot be inspected, and the exact phishing page layout remains unknown.

However, the combination of a recent registration date, German hosting, lack of SSL, and multiple vendor detections strongly suggests a purposeful campaign to harvest credentials or lure victims into fraudulent cryptocurrency transactions. Defenders should continue to block the domain at network perimeter devices and update DNS‑based deny lists with the observed name servers and IP address. Threat‑intelligence feeds that ingest blocklist entries should retain the indicator for future correlation, as the infrastructure may be reused in related campaigns. Monitoring for new domains registered by the same registrar or hosted on the same AS209341 is recommended to detect potential re‑use of this infrastructure.