uniswaps[.]site

Analysis of uniswaps.site, first observed on February 21 2026, indicates a high‑confidence brand‑impersonation campaign targeting Uniswap users. The domain resolves to the Cloudflare IP 104.21.69.173, which belongs to AS13335 and is geolocated in the United States. Use of a Cloudflare front‑end is common among malicious actors seeking to hide origin servers and to benefit from automatic TLS termination; the presented SSL certificate is identified as "WE1", a generic certificate that does not correspond to the legitimate Uniswap domain. The domain appears on five independent security blocklists and has been explicitly flagged by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

VirusTotal reports six detections out of ninety‑three scanners, confirming that multiple anti‑malware engines have identified the host as malicious. AlienVault OTX includes the domain in a single threat‑intel pulse, further corroborating its association with illicit activity. No Safe Browsing verdict or page‑title information is available, and the site is currently offline, which limits real‑time content analysis.

Nonetheless, the combination of brand‑impersonation intent, Cloudflare hosting, low‑trust TLS, and multiple vendor detections constitutes concrete evidence of a crypto‑scam infrastructure. Defenders should add uniswaps.site to URL filtering policies, ensure that any outbound traffic to the IP 104.21.69.173 is blocked, and monitor for future re‑hosting attempts that may reuse the same domain or similar naming patterns. Continuous threat‑intel feeds should be consulted for updates, and any user reports of unsolicited Uniswap‑related messages should be triaged against this indicator.