auth-baseswap-dex-io-us[.]pages[.]dev

This domain is flagged as a high-risk brand_impersonation threat specifically targeting Metamask wallet users. The site masquerades as a legitimate decentralized exchange platform, presenting itself as 'BaseSwap Dex | BaseSwap Exchange Trade & DeFi Platform,' while harvesting cryptocurrency wallet credentials and private keys. The threat vector leverages social engineering tactics common in decentralized finance (DeFi) scams, exploiting user trust in established brand names to facilitate unauthorized access to digital assets. Analysis indicates the domain auth-baseswap-dex-io-us.pages.dev was registered on October 13, 2025, through Cloudflare, Inc. Infrastructure analysis reveals the domain resolves to IP address 172.66.44.155, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing infrastructure attempting to appear legitimate. Detection metrics show 11 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. The domain appears on one security blocklist, and the threat was neutralized by PhishDestroy, though residual risk may persist through cached or mirrored instances. Mitigation requires immediate action from both end users and security teams. Users who interacted with this domain should assume credential compromise and immediately revoke all active wallet sessions, transfer assets to new wallets, and audit transaction histories for unauthorized activity. Security teams should implement DNS-based blocking for the domain and its resolved IP address, while monitoring for related infrastructure patterns such as Cloudflare-hosted pages impersonating DeFi platforms. Wallet providers should issue targeted warnings to users who may have visited the domain, emphasizing the need for hardware wallet adoption and multi-factor authentication for sensitive operations. Continuous monitoring for similar brand_impersonation patterns is recommended, particularly those using 'baseswap' or 'dex' nomenclature in Cloudflare-registered domains.