dex-uniswap[.]app

On 24 July 2026, the domain dex-uniswap.app was identified as a brand-impersonation vector targeting Uniswap. The domain was registered through Name.com, Inc. on 21 February 2026 and is hosted on a Vercel infrastructure that resolves to the IP address 64.29.17.65, which belongs to the Amazon.com, Inc. AS16509 network in the United States. DNS resolution uses the Vercel-provided nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. The site presents the page title “Swap – Uniswap”, indicating an attempt to mimic Uniswap’s swapping interface, although the actual page content has not been publicly disclosed.

Transport security is provided by a Let’s Encrypt certificate (R12) and the server enforces HTTP Strict Transport Security. An HTTP 451 response code was observed, suggesting the content is unavailable or blocked. The domain has been listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded three detections out of ninety‑three scanning engines.

The combination of brand‑specific page title, Vercel hosting, and the use of a reputable SSL provider aligns with known patterns of crypto‑related impersonation campaigns. Given the observed indicators, security teams should add dex-uniswap.app to network‑level deny lists, enforce URL filtering, and monitor for any related sub‑domains or future re‑registrations. Analysts should continue to verify the site’s payload, if any, and correlate traffic logs for potential victim interaction. The current offline status does not preclude re‑activation, so ongoing vigilance is recommended.