SafeMode - Analysis: uniswap123.pages.dev

Visual Capture

Detection Info

https://uniswap123.pages.dev/#/swap

Detected Brand

PaxSwap

Country

International

Confidence

100%

HTTP Status

200

Report ID

a551b5b5-6a0…

Analyzed

2026-03-19 05:26

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T105D112718A083A2E92335ED0EA7563AB62ABB37DF58F101095BD43F087C6F84C927585
CONTENT ssdeep	96:T+fmKjKp+36BDLQRk1ByG/I83mb2zW+L6Sk1aq6vSm1OofPez:SfmKjKwkDsRMZ/v3TLicq6hZfPK

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b3b38c8c9999b926
VISUAL aHash	ff67e76e24180000
VISUAL dHash	62cc4cd84c100000
VISUAL wHash	ffe7e7ee66180000
VISUAL colorHash	07007000000
VISUAL cropResistant	62cc4cd84c100000

Code Analysis

Risk Score 100/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Cryptocurrency users
• Method: Impersonation of PaxSwap platform.
• Exfil: Unknown, likely to steal credentials and drain crypto wallets.
• Indicators: Free hosting, brand logo present.
• Risk: HIGH

🔒 Obfuscation Detected

atob
eval
fromCharCode
hex_escape
unicode_escape
base64_strings

📡 API Calls Detected

GET

📊 Risk Score Breakdown

Total Risk Score

95/100

Contributing Factors

Free Hosting

The site is hosted on a free hosting platform (pages.dev) which is commonly abused for phishing.

Brand Impersonation

The website mimics the UI of PaxSwap which is a known crypto platform.

Obfuscated Javascript

Obfuscation detected.

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

PaxSwap users (International)

Attack Method

Brand impersonation + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
900 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

PaxSwap

Fake Service

Token swapping on PaxSwap.

⚔️ Attack Methodology

Primary Method: Deceptive site

The site impersonates PaxSwap's interface to trick users into connecting their wallets and entering their credentials. This could lead to account compromise and theft of crypto.