uniswap[.]org-fast-connect-v3-walllet[.]com

Analysis of the domain uniswap.org-fast-connect-v3-walllet.com indicates a recent brand‑impersonation campaign targeting Uniswap users. The domain was registered on 21 February 2026 through Web Commerce Communications Limited and is hosted on Cloudflare infrastructure (AS13335, United States) at IP address 104.21.64.1. DNS resolution points to Cloudflare’s authoritative nameservers albert.ns.cloudflare.com and alina.ns.cloudflare.com, and the site presented a Google Trust Services / WE1 SSL certificate, confirming the use of a legitimate certificate authority. HTTP probing returned a 521 status code, indicating that the origin server is currently unavailable; the domain is reported as taken offline.

VirusTotal scans show that eight of ninety‑three security vendors flagged the domain as malicious, and the domain is listed on two independent blocklists, PhishDestroy and ScamSniffer. Detected technologies include Cloudflare’s edge services and HTTP/3 support, consistent with the observed hosting configuration. The page title returned by the server is “org‑fast‑connect‑v3‑walllet.com | 521: Web server is down”, providing no further content for content‑based analysis. The evidence confirms the domain’s intent to masquerade as a Uniswap service, likely to lure cryptocurrency users into a scam.

Uncertainty remains regarding the specific payload or phishing page that may have been served before the takedown, as no content snapshots are available. Defenders should continue to block the domain at network perimeter, update URL filtering rules to include the observed hostnames, and monitor for any resurgence of similar sub‑domains. Ongoing observation of Cloudflare‑associated IP ranges and the registrar’s new registrations is recommended to detect future campaigns employing comparable infrastructure.