# PhishDestroy domain threat record: baseswap-app.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/baseswap-app.github.io/
Machine-readable companion: https://phishdestroy.io/domain/baseswap-app.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-14 13:54:39 UTC
- Last availability or vendor check: 2026-10-21 01:16:10 UTC
- Stored record updated: 2026-10-22 14:21:07 UTC
- VirusTotal detections in the stored snapshot: 2/89
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Base

## Stored infrastructure

- Observed IP address: 185.199.108.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 404
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/baseswap-app.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.baseswap-app.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://baseswap-app.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
baseswap-app.github.io is an impersonation phishing page built to pass as BaseSwap, a decentralized exchange on the Base network, and it targets traders who search for the swap app and land on a lookalike. PhishDestroy first saw it on 2026-09-14. The site has been offline since 2026-09-21, and it was still dead when last checked on 2026-10-19.

How the scam works
Fake DEX front-ends copy the look of the real swap interface and push visitors to connect a wallet. They then ask the visitor to sign what looks like a routine swap or approval, but the transaction actually grants token spending rights or transfers assets to the attacker. Some versions also ask for a seed phrase under the pretext of a sync or fixing an error. Either way, the victim can lose whatever tokens the signed permission or exposed key reaches. The page now returns "Site not found · GitHub Pages", which shows the project has been removed, while our classification reflects the impersonation it hosted while it was active.

Evidence
On 2026-09-22, VirusTotal showed only 2 of 89 engines flagging the address, ChainPatrol and alphaMountain.ai. That is a thin count, but ChainPatrol focuses on crypto brand abuse, so its flag carries weight for this kind of lure. Stronger support comes from wallet-security lists. MetaMask and SEAL both block the domain alongside PhishDestroy, which means MetaMask users get a warning before they can interact with it.

Infrastructure
The page sits on a GitHub Pages subdomain, so there was no domain to register, and setting it up cost nothing and took minutes. Traffic resolves to Fastly, Inc. in the US, the content delivery network that serves GitHub Pages. That setup lets operators borrow a trusted platform address. It also means that one project removal takes the page down, which matches the short gap between first sighting on 2026-09-14 and the outage on 2026-09-21.

What to do
If you connected a wallet to this page, check for token approvals you did not intend and revoke them, especially unlimited allowances granted around mid-September 2026. If you typed a seed phrase into it, treat that wallet as compromised and move your remaining funds to a newly generated wallet immediately. Reach BaseSwap only through a bookmarked address or its official channels, not through search ads or links in direct messages. Defenders should block the hostname and watch for new github.io projects that use the BaseSwap name, then report them to GitHub and to crypto blocklist maintainers.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/baseswap-app.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=baseswap-app.github.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:48 UTC

## Stored page captures

- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/571a033f-e4c8-424f-b9ad-2e75c53e24cc.png
  Captured: 2026-09-21 07:59:12 UTC
  Source report: https://radar.cloudflare.com/scan/571a033f-e4c8-424f-b9ad-2e75c53e24cc
  SHA-256: 945c4699741e079455940b39652bded28d3c3ecc2dde09ffe7aaa9f9d3ff0ddc

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:30:57Z",
        "uuid": "571a033f-e4c8-424f-b9ad-2e75c53e24cc",
        "scanned_at": "2026-09-21T07:59:12Z",
        "final_url": "https://baseswap-app.github.io/",
        "status": 404,
        "history": [
            {
                "url": "https://baseswap-app.github.io/",
                "status": 404
            }
        ],
        "dom_hash": "35bbdd99a249decabdc93f6b809b030db834533d4d78fe69529a214489fae670",
        "doc_hash": "70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "baseswap-app.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "baseswap-app.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "baseswap-app.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "baseswap-app.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "baseswap-app.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "name": "baseswap-app.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "name": "baseswap-app.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "name": "baseswap-app.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.108.153",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T01:53:59Z",
        "analysis_at": "2026-09-14T11:02:56Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 2,
            "suspicious": 0,
            "undetected": 36
        },
        "detections": {
            "ChainPatrol": "malicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Information Technology, Phishing (alphaMountain.ai)"
        },
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-14T11:27:53Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            }
        ],
        "dns_at": "2026-09-14T11:28:04Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "59e7c420f8943f524ab370807c836bb57fe",
            "sha256": "71f1077db377fd7b8d68380da66fa68238a303b2911bcb770b3b2a426693cf84",
            "subject": "*.github.io",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```