auth-baseswapp-exchange[.]pages[.]dev

The domain auth-baseswapp-exchange.pages.dev is an active brand impersonation threat targeting the Base cryptocurrency platform. Specifically, it mimics the legitimate BaseSwap Exchange decentralized trading interface to deceive users into connecting their wallets, at which point a crypto drainer kit is deployed to siphon funds. This domain was registered through Cloudflare, Inc. and currently resolves to IP address 188.114.96.3, with a creation date of April 04, 2026. VirusTotal data indicates that 1 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. Despite these detections, the domain remains active and accessible.

The technical indicators paint a clear picture of risk. The SSL certificate is issued by Google Trust Services (WE1), which is legitimate but can be obtained easily by threat actors. The domain uses Cloudflare as both registrar and CDN, which helps it evade some takedown efforts. The page title 'BaseSwap Exchange – Next-Gen Decentralized Trading' is a direct copy of the legitimate site's branding, and no additional phishing kits beyond the drainer have been identified. The low detection rate on VirusTotal (1/95) suggests the domain is relatively new and has not yet been widely reported. It does not appear on Google Safe Browsing blocklists at this time, which increases the urgency for user awareness.

As of this writing, the domain is still active and poses a high risk to BaseSwap users. PhishDestroy has flagged this domain and recommends that users avoid interacting with any URLs containing 'auth-baseswapp-exchange.pages.dev'. If you have already connected your wallet to this site, immediately revoke token approvals and transfer assets to a new wallet. Report the domain to Cloudflare's abuse team and to the BaseSwap team for takedown. Always verify official URLs directly from the project's official sources before connecting your wallet or entering sensitive information.