# PhishDestroy domain threat record: com-v3-swap-portal-gateway.cloud Content language: English Canonical HTML report: https://phishdestroy.io/domain/com-v3-swap-portal-gateway.cloud/ Machine-readable companion: https://phishdestroy.io/domain/com-v3-swap-portal-gateway.cloud/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-14 19:29:44 UTC - Last availability or vendor check: 2026-10-22 10:00:31 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 103.224.182.189 - Registrar in stored WHOIS data: Web Commerce Communications Ltd. - Registrar country in stored WHOIS data: MY - Last stored HTTP status: 200 - Registration date (registry RDAP, com-v3-swap-portal-gateway.cloud): 2025-10-12 17:15:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a13bf0-d61f-777f-8120-e9db43fdb956/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/com-v3-swap-portal-gateway.cloud - Certificate Transparency search: https://crt.sh/?q=%25.com-v3-swap-portal-gateway.cloud - Web Archive lookup: https://web.archive.org/web/*/https://com-v3-swap-portal-gateway.cloud/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview com-v3-swap-portal-gateway.cloud is an impersonation phishing page built to look like the official gateway to a v3 decentralized swap protocol. The "com-" prefix and the "v3-swap" wording are there to pass a quick glance from traders hunting for a swap interface. PhishDestroy first flagged it on 2026-10-14. The site was still online and serving content when last checked on 2026-10-19. How the scam works The page title is just the domain name, so the bait is the address itself rather than a polished brand banner. Fake swap portals like this typically show a familiar trading screen and ask the visitor to connect a wallet to swap, claim or migrate tokens. The real action is a transaction or signature request that grants the operator spending rights over the victim's tokens. Once that is approved, assets can be moved out without any further prompt, and on-chain transfers cannot be reversed. Evidence Wallet-focused defenders have already acted: MetaMask and SEAL both list the domain alongside PhishDestroy, which means wallet users on those protections should see a warning. Spamhaus lists it in its domain blocklist under the phishing category (DBL_PHISH). On VirusTotal only 5 of 92 engines flagged it as of 2026-10-18: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. That coverage is thin, so most general antivirus and browser filters will still let the page load. Infrastructure The domain was registered on 2025-10-12 through Web Commerce Communications Ltd., about a year before it surfaced as a live phishing page. A domain held that long before use can slip past filters that focus on newly registered names. It resolves to an address on the Trellian Pty. Limited network, which is geolocated to the US. A free Let's Encrypt certificate gives it the padlock icon, and that padlock says nothing about who runs the site. What to do If you connected a wallet here, use a token-approval checker to revoke every permission you granted from that session, then move remaining funds to a fresh wallet. If you typed a seed phrase or private key into the site, treat that wallet as compromised and empty it immediately. Reach swap protocols only through bookmarks or verified sources, never through links or search ads. Security teams should block the domain at DNS and proxy level and add it to wallet and email filtering, since most antivirus engines do not yet cover it. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a13bf0-d61f-777f-8120-e9db43fdb956/ VirusTotal report: https://www.virustotal.com/gui/domain/com-v3-swap-portal-gateway.cloud Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=com-v3-swap-portal-gateway.cloud Archived copy: https://web.archive.org/web/20261014193828/https://com-v3-swap-portal-gateway.cloud/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:25:13 UTC ## Stored page captures - Primary capture: https://i.ibb.co/tpJscq1s/e32db9d541d3.png Captured: 2026-10-14 19:44:09 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a13bf0-d61f-777f-8120-e9db43fdb956.png Captured: 2026-10-14 19:44:09 UTC Source report: https://urlscan.io/result/01a13bf0-d61f-777f-8120-e9db43fdb956/ - URLScan capture 2: https://urlscan.io/screenshots/01a1394a-f011-733b-8f51-097f39c33a41.png Captured: 2026-10-14 19:29:44 UTC Source report: https://urlscan.io/result/01a13bf0-d61f-777f-8120-e9db43fdb956/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5059e147-b28d-42c8-9f5e-348065958397.png Captured: 2026-10-14 19:35:13 UTC Source report: https://radar.cloudflare.com/scan/5059e147-b28d-42c8-9f5e-348065958397 SHA-256: e214588139f70a79065da0f54ba3dff4d4323cf3d7e3e7dd99f1062801e8eb2d - URLQuery: https://screenshots.phishdestroy.io/uq/727088c1-14ef-410a-b6ed-640e0e8e27d5.png Source report: https://urlquery.net/report/727088c1-14ef-410a-b6ed-640e0e8e27d5 SHA-256: 7ca42eb354d40e7ba2d45dfd5adfd661dc33e7046454e507205ac009b4c58e92 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T17:47:58Z", "uuid": "01a13bf0-d61f-777f-8120-e9db43fdb956", "scanned_at": "2026-10-14T19:43:27Z", "final_url": "https://com-v3-swap-portal-gateway.cloud/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://com-v3-swap-portal-gateway.cloud/", "from": "http://com-v3-swap-portal-gateway.cloud/", "status": 307 } ], "ip": "103.224.182.189", "ptr": "lb-182-189.above.com", "domains": [ "assets.abovedomains.com" ], "ips": [ "185.111.111.156", "103.224.182.189" ], "asns": [ "212238", "133618" ], "countries": [ "DE", "US" ], "link_domains": [ "webnic.cc" ], "doc_hash": "1ea86e998e6bb665a1eae92e6709345b077e74a61f5c9b72ea02d9de8b31626e", "tls": { "san": [ "*.5daa51fa-34a3-4f6a-8d36-2315a96a322a.monokini.uk", "*.analytics.monokini.uk", "*.api.monokini.uk", "*.autotask.monokini.uk", "*.backup.monokini.uk", "*.c45185347.com", "*.calendar.monokini.uk", "*.correu.monokini.uk", "*.d80438832.com", "*.dashboard.monokini.uk" ], "cipher": "AES_256_GCM", "issuer": "YE2", "subject": "monokini.uk", "protocol": "TLS 1.3", "valid_to": "2027-01-11T00:32:30Z", "valid_from": "2026-10-13T00:32:31Z" }, "domain_age_days": 366, "apex_age_days": 366, "tls_age_days": 1, "tls_valid_days": 89, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 53, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:00:41Z", "uuid": "5059e147-b28d-42c8-9f5e-348065958397", "scanned_at": "2026-10-14T19:35:13Z", "final_url": "https://com-v3-swap-portal-gateway.cloud/", "status": 200, "history": [ { "url": "https://com-v3-swap-portal-gateway.cloud/", "status": 200 } ], "dom_hash": "f737d713dbf8c2aa26cc80eb4c4bbd657f709164e12199b75b72a4d0c4d8e763", "doc_hash": "9129fb00a1aa49204b9825677e4ea919e4bd09cf7c25c8992602d3c67a7b5677", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "com-v3-swap-portal-gateway.cloud", "type": "A", "value": "103.224.182.189" } ], "dnssec_valid": false, "ip": "103.224.182.189", "whois": { "registrar": "Web Commerce Communications Ltd.", "created": "2025-10-12T17:15:58Z", "updated": "2026-10-12T17:16:26Z", "expires": "2027-10-12T17:15:58Z", "nameservers": [ "ns100.webnic.cc", "ns101.webnic.cc" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T21:12:04Z", "analysis_at": "2026-10-19T05:11:02Z", "stats": { "timeout": 0, "harmless": 56, "malicious": 0, "suspicious": 0, "undetected": 36 }, "reputation": 0, "tags": [ "dga" ], "created": "2025-10-12T00:00:00Z", "updated": "2025-12-22T00:00:00Z", "first_seen": "2025-10-13T06:42:46Z", "dns": [ { "ttl": 21600, "type": "A", "value": "103.224.182.189" }, { "ttl": 21600, "type": "SOA", "rname": "hostmaster.com-v3-swap-portal-gateway.cloud", "value": "com-v3-swap-portal-gateway.cloud" }, { "ttl": 21600, "type": "NS", "value": "synth-ip-c0a86410.com-v3-swap-portal-gateway.cloud" } ], "dns_at": "2026-10-19T05:22:32Z", "jarm": "28d28d28d00028d00042d42d00000051af7d8070a18e002eaaedf620fa118c", "cert": { "san": [ "*.5daa51fa-34a3-4f6a-8d36-2315a96a322a.monokini.uk", "*.analytics.monokini.uk", "*.api.monokini.uk", "*.autotask.monokini.uk", "*.backup.monokini.uk", "*.c45185347.com", "*.calendar.monokini.uk", "*.correu.monokini.uk", "*.d80438832.com", "*.dashboard.monokini.uk" ], "issuer": "Let's Encrypt / YE2", "serial": "62ab0c66976af8bdd911c07cbfce5ca2fa8", "sha256": "1c04b596ea85ce687def21bbd4b1d8143c7062d6115317233d3dbc48f7d528d0", "subject": "monokini.uk", "valid_to": "2027-01-11T00:32:30Z", "valid_from": "2026-10-13T00:32:31Z" }, "rdap": { "status": [ "active" ], "events": { "expiration": "2026-10-11T16:00:00Z", "last changed": "2025-10-12T16:00:00Z", "registration": "2025-10-12T16:00:00Z", "last update of RDAP database": "2025-10-11T17:00:00Z" }, "registrar": "WebNIC", "registrar_iana_id": "460" } } } ```