base-swapp-deex[.]pages[.]dev

Analysis of base-swapp-deex.pages.dev indicates a high-risk fake decentralized exchange (DeFi) scam targeting cryptocurrency users. The domain, registered on April 24, 2026, through Cloudflare, resolves to IP 188.114.96.3 (Cloudflare infrastructure, CA) and is currently active with an HTTP 200 status. The page title, 'BaseSwap ® DEX | Secure DeFi Exchange & Login Help,' explicitly suggests impersonation of a legitimate DeFi platform, though no confirmed brand association exists beyond the title. Infrastructure reveals Cloudflare nameservers (charles.ns.cloudflare.com, destiny.ns.cloudflare.com) and technologies including HSTS and HTTP/3, which are consistent with modern phishing sites leveraging CDN protections to evade takedowns. Security vendor detection remains minimal but notable: 1 of 94 vendors on VirusTotal flags the domain, and it appears on one blocklist (PhishDestroy). The Gridinsoft trust score of 0/100 further supports malicious classification. The scam type is explicitly labeled as a 'Fake Exchange,' aligning with the page title's DeFi theme. No evidence of credential harvesting mechanisms or wallet-draining scripts is currently available, as the site content has not been analyzed. Defenders should treat this domain as actively malicious, prioritizing blocking at DNS or proxy levels. Given the low detection rate but high-risk indicators, monitoring for additional vendor confirmations or victim reports is recommended. The domain's recent registration (under 90 days old) and Cloudflare hosting are typical of short-lived phishing campaigns.