4432989893843755838403843984399997777939y3939j[.]jvjkogjv[.]workers[.]dev

The domain 4432989893843755838403843984399997777939y3939j.jvjkogjv.workers.dev is identified as a high-risk brand impersonation threat targeting Uniswap, a decentralized cryptocurrency exchange. Analysis indicates the domain was designed to mimic the official Uniswap interface, presenting the page title 'Uniswap | Trade Crypto on DeFi’s Leading Exchange' to deceive users into disclosing sensitive credentials or wallet information. Current status of the domain is offline, though prior activity suggests active exploitation attempts. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., resolving to the IP address 104.21.81.171. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains. The domain is flagged by 19 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. It appears on three security blocklists and is blocked by at least three major security providers. Technologies detected on the domain include jsDelivr, HSTS, crypto-js, Cloudflare, and HTTP/3, which are consistent with modern web infrastructure but also leveraged in phishing campaigns for obfuscation and evasion. The domain has been taken offline, reducing immediate risk to users. However, the infrastructure and tactics observed align with persistent phishing campaigns targeting cryptocurrency platforms. Organizations and individuals are advised to monitor for similar domains using Cloudflare Workers subdomains, particularly those impersonating DeFi services. Users should verify domain authenticity through official channels before interacting with any platform requesting wallet credentials or private keys. Security teams are recommended to update blocklists with the provided indicators and conduct retrospective analysis for any prior exposure to this domain.