guid-baseswap-dex[.]pages[.]dev

The domain guid-baseswap-dex.pages.dev is actively serving a website that mimics the official BaseSwap decentralized exchange. The page title “BaseSwap DEX – Official Decentralized Exchange on Base Network” and the use of the Base brand are intended to lure users into believing the site is a legitimate trading interface on the Base network. The threat classification is brand impersonation with a fake exchange payload, indicating a high‑risk profile.

The domain was registered on 2026-04-05 through a CDN provider and resolves to the IP address 172.66.47.50, which is hosted in Canada and associated with the provider’s edge network. Authoritative nameservers ariadne.ns.cloudflare.com and chris.ns.cloudflare.com resolve the domain. The site returns HTTP 200 and presents an SSL certificate issued by a recognized certificate authority, confirming that transport encryption is in place but does not validate the underlying content.

Reputation data shows the domain appears on three independent security blocklists and has been flagged by one out of ninety‑five VirusTotal scanners. A commercial trust‑score service assigns a score of zero out of one hundred, reflecting a complete lack of trust. The domain is currently listed as active, and its content remains reachable.

Open questions include the specific phishing kit or smart‑contract code used to harvest credentials or funds, as these details have not been disclosed publicly. Defenders should block DNS resolution for guid-baseswap-dex.pages.dev, monitor outbound connections to its IP address, and enforce URL filtering for any pages containing the BaseSwap branding. Users should be warned that any request to this domain is likely a fraudulent attempt to capture private keys or execute unauthorized token swaps.