uniswap123[.]pages[.]dev

This domain, uniswap123.pages.dev, is flagged as a high-risk brand impersonation threat targeting Uniswap, a decentralized cryptocurrency exchange. Analysis indicates the site mimics Uniswap’s branding while presenting an unrelated page title, PaxSwap, suggesting an attempt to deceive users into interacting with fraudulent content. No direct evidence of a crypto drainer kit was identified, but the domain’s structure and impersonation tactics align with common phishing methodologies used to harvest credentials or distribute malicious payloads.

Technical indicators reveal the domain was registered on August 26, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.45.38, hosted on Cloudflare’s infrastructure (AS13335). VirusTotal detection shows 1 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate is classified as WE1, and the domain remains unlisted in Google Safe Browsing (GSB) at the time of analysis. Infrastructure analysis confirms the domain is still active, with no evidence of takedown or mitigation efforts.

Current status indicates the domain remains operational, posing a continued risk to users who may mistake it for the legitimate Uniswap platform. Response actions should include immediate blocklisting at the network level, particularly for organizations handling cryptocurrency transactions. Users are advised to verify domain authenticity by cross-referencing official sources and avoiding interaction with pages displaying mismatched branding or titles. Given the domain’s recent creation and low detection rate, heightened vigilance is recommended, as threat actors may leverage such sites for credential theft or secondary payload delivery.