kyberswapnet[.]pages[.]dev

kyberswapnet.pages.dev is a brand impersonation domain specifically designed to mimic the legitimate KyberSwap platform while targeting the Base blockchain ecosystem. This domain was registered on February 22, 2025, through Cloudflare, Inc., and was configured with an SSL certificate from SSL Corporation under Cloudflare's TLS Issuing ECC CA 3. The page title, "KyberSwap - Limitless Access To DeFi," was crafted to deceive users into believing they were accessing the authentic KyberSwap interface, thereby facilitating credential theft or cryptocurrency drainer activities.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis shows 2 out of 95 security vendors flagging this domain as malicious, and it appears on 2 security blocklists. The domain resolves to IP address 188.114.96.3, which is associated with Cloudflare's infrastructure. Notably, Google Safe Browsing has not yet flagged this domain, but the presence on multiple blocklists and the low but significant vendor detection rate underscore its deceptive nature. The domain's creation date, just days before detection, is a hallmark of phishing operations that rapidly spin up and tear down infrastructure.

As of the latest check, kyberswapnet.pages.dev has been taken offline, indicating a successful takedown response. However, the underlying infrastructure and threat actors remain active, and similar domains may reappear under different subdomains or registrars. Users who may have interacted with this domain should immediately rotate any credentials entered, enable two-factor authentication on their crypto wallets, and monitor for unauthorized transactions. PhishDestroy recommends blocking this domain at the network level and educating users about the risks of interacting with unsolicited DeFi platforms, especially those with recent registrations and mismatched brand targets.