unieswaechange[.]webflow[.]io

The domain unieswaechange.webflow.io was identified as a brand‑impersonation campaign targeting Uniswap, with a reported risk level of elevated. The site was registered through MarkMonitor, Inc. on May 08, 2013 and resolves to the Cloudflare‑owned address 172.64.151.8, located in the United States under ASN 13335. The domain is served via Cloudflare, employing HTTP/3 and presenting an SSL certificate issued by Google Trust Services under the WE1 label, indicating a valid TLS termination. DNS resolution is handled by journey.ns.cloudflare.com and lamar.ns.cloudflare.com.

A VirusTotal scan returned nine positive detections out of ninety‑five security vendors, and the domain appears on a single external blocklist. PhishDestroy has also taken action to block the domain. An HTTP request returned a 404 status, and the only observable page title is “Uniswap exchange - Distributed trading platform,” confirming the intent to masquerade as the official Uniswap service. The site is currently offline, limiting the ability to capture additional artefacts such as login forms or malicious payloads.

Defenders should immediately add the IP address 172.64.151.8 and the domain name to network‑level deny lists, and monitor for any new subdomains that resolve to the same Cloudflare infrastructure. Given the presence of multiple vendor detections and the involvement of a reputable registrar, the domain should be treated as a confirmed malicious indicator. Continuous ingestion of threat‑intel feeds that reference this domain, along with periodic re‑resolution checks, is recommended to detect any future re‑activation attempts.