derforexs[.]top

The domain derforexs.top was registered on August 08, 2025 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 104.21.70.17, which resolves to a US location. The authoritative nameservers are leif.ns.cloudflare.com and norah.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site presents a TLS certificate issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint despite the malicious intent. HTTP requests to the host return a 403 status code, and the site is currently reported as offline, yet historical evidence shows it was active enough to be captured by multiple security products.

VirusTotal recorded 13 detections out of 95 scanned vendors, and AlienVault OTX references the domain in 17 distinct threat‑intelligence pulses, demonstrating recurring observation across independent feeds. The domain appears on one security blocklist and has been specifically blocked by PhishDestroy, reinforcing its classification as a malicious resource. Scamadviser assigns a trust score of 1 / 100, underscoring its low credibility. The page title returned by the server is "Uniswap," matching the declared brand target, and the threat is cataloged as a crypto‑scam that impersonates Uniswap.

For defenders, immediate remediation should include adding derforexs.top and its resolving IP 104.21.70.17 to network deny lists, updating URL filtering policies to block the domain, and ensuring endpoint protection solutions are configured to recognize the 13 VirusTotal detections. Continuous monitoring of Cloudflare‑associated IP ranges for similar impersonation patterns is advised, as the infrastructure can be reused for future campaigns. Incident response teams should also flag any outbound traffic to this domain as suspicious and correlate logs with the OTX pulse identifiers to detect potential lateral activity.