uni-checker[.]net

Analysis of the domain uni-checker.net indicates it was actively involved in a crypto scam impersonating Uniswap, a decentralized cryptocurrency exchange. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335). Nameservers carmelo.ns.cloudflare.com and grace.ns.cloudflare.com were utilized, consistent with Cloudflare's DNS services. No SSL certificate was detected, increasing the risk of unencrypted data transmission. The domain was flagged as malicious by 14 of 93 security vendors on VirusTotal, and it appeared on at least one security blocklist.

Gridinsoft assigned a trust score of 0 out of 100, further corroborating its malicious classification. AlienVault OTX listed the domain in a threat intelligence pulse, while PhishDestroy explicitly blocked it. The page title, 'Track your airdrop on Uniswap,' aligns with a known phishing kit targeting cryptocurrency users under the pretense of airdrop tracking. This kit is classified as an 'Airdrop Scam' in available intelligence. As of July 23, 2026, the domain is offline, though its prior infrastructure and detection history suggest it was operational long enough to pose a credible threat.

Defenders should treat any prior resolution of this domain as malicious and update blocklists accordingly. Given the use of Cloudflare, additional scrutiny of domains leveraging similar hosting patterns is recommended. The exact duration of the campaign and the total number of victims remain uncertain due to the domain's current offline status. No further details about the phishing kit's payload or backend infrastructure are available at this time.