# PhishDestroy domain threat record: uniswap-v3-simulator.onrender.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/uniswap-v3-simulator.onrender.com/ Machine-readable companion: https://phishdestroy.io/domain/uniswap-v3-simulator.onrender.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-31 18:43:38 UTC - Last availability or vendor check: 2026-10-22 10:10:11 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Uniswap ## Stored infrastructure - Observed IP address: 216.24.57.7 - Registrar in stored WHOIS data: Render Services Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, onrender.com): 2015-03-28 01:20:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a05921-0b34-7552-820f-856ec656f327/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/uniswap-v3-simulator.onrender.com - Certificate Transparency search: https://crt.sh/?q=%25.uniswap-v3-simulator.onrender.com - Web Archive lookup: https://web.archive.org/web/*/https://uniswap-v3-simulator.onrender.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview This site poses as a Uniswap V3 tool, titled "Uniswap V3 Simulator," and targets DeFi traders and liquidity providers who expect a familiar Uniswap interface. PhishDestroy first flagged it on 2026-08-31 as an impersonation phishing page. As of 2026-10-19, it is still online and serving its content. The page title presents a simulator, a format that sounds harmless, but we classified the site as a phishing page impersonating Uniswap. How the scam works Uniswap impersonation pages borrow the brand's look and name to win trust, then steer visitors toward actions that hand over control of their funds. Typically, the visitor is asked to connect a wallet and approve a transaction or sign a message presented as a routine step, such as loading positions or running a simulation. One signed token approval or permit can let the operator move assets out of the wallet later, without further prompts. A "simulator" framing works well here because users assume a testing tool cannot touch real money. Evidence On 2026-10-15, VirusTotal showed 3 of 92 engines flagging the site: alphaMountain.ai, Forcepoint ThreatSeeker and Fortinet. That is a low count, so most security tools would let a visitor through without warning. Stronger backing comes from crypto-specific defenses. MetaMask's blocklist and SEAL both list the domain alongside PhishDestroy, which means wallet users with those protections should see a warning. Infrastructure The page runs on a subdomain of Render's free app-hosting platform, on Render's network in the US. The 2015-03-28 registration date and the registrar, Render Services Inc., belong to the shared platform domain, not this operator. So domain age reveals nothing about how long this page has existed. Its Google Trust Services certificate is the platform's automatic default, so the padlock in the browser only confirms an encrypted connection, not a legitimate site. What to do If you only viewed the page, close it and reach Uniswap through a bookmark you saved yourself. If you connected a wallet and signed or approved anything, revoke the token approvals granted during that session with a reputable approval checker right away. Then move any remaining assets to a fresh wallet if you entered a seed phrase or are unsure what you signed. Defenders should block the hostname, report it to Render's abuse team, and alert users that Uniswap-branded "simulators" on free hosting platforms are not official. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05921-0b34-7552-820f-856ec656f327/ VirusTotal report: https://www.virustotal.com/gui/domain/uniswap-v3-simulator.onrender.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=uniswap-v3-simulator.onrender.com Archived copy: https://web.archive.org/web/20260831184535/https://uniswap-v3-simulator.onrender.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:52:44 UTC ## Stored page captures - Primary capture: https://i.ibb.co/KpBj4RdY/eb4fee1e3508.png Captured: 2026-08-31 18:43:38 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05921-0b34-7552-820f-856ec656f327.png Captured: 2026-08-31 18:43:38 UTC Source report: https://urlscan.io/result/01a05921-0b34-7552-820f-856ec656f327/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:24:45Z", "uuid": "01a05921-0b34-7552-820f-856ec656f327", "scanned_at": "2026-08-31T18:42:20Z", "final_url": "https://uniswap-v3-simulator.onrender.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://uniswap-v3-simulator.onrender.com/", "from": "http://uniswap-v3-simulator.onrender.com/", "status": 307 } ], "ip": "216.24.57.15", "ptr": "ip-216-24-57-15.ingress.render.com", "ips": [ "216.24.57.15" ], "asns": [ "397273" ], "countries": [ "US" ], "link_domains": [ "twitter.com" ], "social": [ "http://twitter.com/omarish" ], "doc_hash": "12017430fdb546d968af9b3f6401f155f0f2cb5fc02d177e250fb4bf93178c12", "script_hashes": [ "71a696b084b7cfc81ada538814f1e616b7867afdd16c6e2eddcfb260166355df", "5e1eb08ac9753edcc1dcdf4373cb065364f5dc949a2a97bbca85eaf289031a86" ], "globals": [ "global", "__import__" ], "tls": { "san": [ "onrender.com", "*.onrender.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "onrender.com", "protocol": "TLS 1.3", "valid_to": "2026-10-22T21:54:17Z", "valid_from": "2026-07-24T20:54:20Z" }, "domain_age_days": 1946, "apex_age_days": 1946, "tls_age_days": 37, "tls_valid_days": 90, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=315360000; includeSubdomains; preload", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:36:20Z", "uuid": "b3f2e18c-999e-4779-8229-21ba4da38612", "scanned_at": "2026-08-31T19:22:35Z", "final_url": "https://uniswap-v3-simulator.onrender.com/", "status": 200, "history": [ { "url": "https://uniswap-v3-simulator.onrender.com/", "status": 200 } ], "dom_hash": "7fb06f80829087651cd5d600cbb18c06f3485093d8faebfa6974f2fcc234b71f", "doc_hash": "12017430fdb546d968af9b3f6401f155f0f2cb5fc02d177e250fb4bf93178c12", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "uniswap-v3-simulator.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" }, { "name": "uniswap-v3-simulator.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" } ], "dnssec_valid": false, "ip": "216.24.57.15", "whois": { "registrar": "Amazon Registrar, Inc.", "created": "2015-03-28T01:20:58Z", "updated": "2026-05-15T17:25:02Z", "expires": "2027-03-28T01:20:58Z", "nameservers": [ "ns-1324.awsdns-37.org", "ns-1829.awsdns-36.co.uk", "ns-245.awsdns-30.com", "ns-813.awsdns-37.net" ] } } } ```