base-swap-exchang-en[.]pages[.]dev

PhishDestroy flags the domain base-swap-exchang-en.pages.dev as an active brand impersonation site targeting the Base ecosystem. The page uses a near-identical visual clone of Base’s branding to trick users into connecting wallets or transferring funds. No crypto drainer artifacts are confirmed yet, but the site’s motivation aligns with known drainer behavior: prompting wallet connections under the guise of a “Base Swap Exchange.” Cloudflare Pages hosts the content, which serves as a low-friction front-end to collect seed phrases or sign malicious transactions. This domain resolves to IP 172.66.47.181 and is registered through Cloudflare, Inc., leveraging Google Trust Services for its SSL certificate. VirusTotal currently reports 0 detections out of 95 engines, indicating zero detections at the time of analysis. Creation metadata is obscured via Cloudflare’s proxy, so registration date remains unverified. The page has not yet been added to Google Safe Browsing or major blocklists, leaving open channels for traffic from impatient or unsuspecting users. Status is active and under investigation; no takedown has occurred. Users should block the domain locally, refrain from visiting or connecting wallets, and share IOCs with security teams. Risk remains elevated until Cloudflare removes the site or Google Safe Browsing flags the page. PhishDestroy continues to monitor for changes in payload delivery or drainer kit integration.