# PhishDestroy threat dossier — uniswaponbase.com ================================================================ Fetched: 2026-07-22 10:03:27 UTC Canonical: https://phishdestroy.io/domain/uniswaponbase.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Brand Impersonation Targeted brand: Uniswap ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: Forcepoint ThreatSeeker Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 52.223.13.41 (US, Seattle) ASN: ASAS16509 AMAZON-02 - Amazon.com, Inc., US Hosting org: AS16509 Amazon.com, Inc. Registrar: TUCOWS.COM, CO. Nameservers: ns1.renewyourname.net, ns2.renewyourname.net Registered: 2024-06-15 Expires: 2027-06-15 HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: GoDaddy.com / GoDaddy TLS Intermediate CA DV - R1v1 Expires: 2027-01-03 Status: INVALID chain Fingerprint: 454b4eb54e39c9beb6a58c4daf3b380e0a5efb0519cbc37d7995e4229e123903 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2024-06-15 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-21 07:44:45 UTC (by PhishDestroy tracker) First reported: 2026-06-21 05:47:18 UTC (abuse notice filed) Last verified: 2026-07-22 08:20:29 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019ee8b5-0442-74a2-adda-4b69ea586555/ URLQuery: https://urlquery.net/report/9ff0bdf8-b898-4490-a87f-06347d39945a Wayback Machine: https://web.archive.org/web/*/uniswaponbase.com crt.sh CT logs: https://crt.sh/?q=%25.uniswaponbase.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=uniswaponbase.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/uniswaponbase.com URLhaus: https://urlhaus.abuse.ch/host/uniswaponbase.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-22 23:02:27 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Uniswap impersonation via uniswaponbase.com Uniswaponbase.com actively impersonates the Uniswap platform, aiming to deceive users into divulging sensitive information. This domain is already flagged as malicious by one out of 95 VirusTotal vendors, reflecting its recognition as a threat. Additionally, it is listed on three public blocklists, including those maintained by MetaMask and SEAL, highlighting its notoriety within the cybersecurity community. Registered with TUCOWS.COM, CO. and hosted on an IP address associated with Amazon.com, Inc., the domain leverages a GoDaddy-issued SSL certificate. Despite these legitimate-seeming credentials, the site's primary objective is to trick users into believing they are interacting with the authentic Uniswap service. The domain's creation date is June 15, 2024, and it was identified by PhishDestroy on June 21, 2026, indicating a relatively recent emergence in the phishing landscape. The platform risk score of 78 out of 100 underscores the potential danger posed by uniswaponbase.com. The site's active status and its presence on multiple blocklists suggest a concerted effort to exploit Uniswap's brand trust. This scam type is particularly concerning as it targets users familiar with decentralized finance platforms, who may not immediately question the authenticity of a site mimicking a well-known brand like Uniswap. Given the domain's active status and its ongoing impersonation efforts, it remains a significant threat to users seeking to engage with the legitimate Uniswap service. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260621-F55D1F TLS cert SHA-256: 454b4eb54e39c9beb6a58c4daf3b380e0a5efb0519cbc37d7995e4229e123903 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/uniswaponbase.com/ JSON API: https://api.destroy.tools/v1/check?domain=uniswaponbase.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 187,839 domains (57,400 alive under monitoring, 128,795 confirmed takedowns/dead). Site: https://phishdestroy.io