dapp-papatrump[.]pages[.]dev

This domain, dapp-papatrump.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ethereum users. Analysis indicates the site operates under the title 'COIN NODE' and is designed to mimic legitimate Ethereum decentralized application (dApp) interfaces, likely functioning as a crypto drainer to siphon digital assets from victims. No specific drainer kit has been attributed at this time, but the infrastructure aligns with known patterns of wallet-draining campaigns observed in recent months. Infrastructure analysis reveals the domain was registered on July 29, 2024, through Cloudflare, Inc., and resolves to the IP address 172.66.46.243, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious domains leveraging Cloudflare's proxy services. VirusTotal detection shows 12 out of 95 security vendors flagging the domain as malicious, while it appears on two security blocklists. Google Safe Browsing (GSB) status is not explicitly provided, but the domain remains active and unmitigated at the time of analysis. Current status confirms the domain is still operational, posing an ongoing risk to users who may interact with it under the false pretense of accessing Ethereum-related services. Response actions by security vendors, including PhishDestroy and ScamSniffer, have blocked the domain, but no takedown or registrar-level intervention has been observed. The remaining risk is classified as high due to the domain's active status, Cloudflare-hosted infrastructure, and direct targeting of cryptocurrency users. Users are advised to verify domain authenticity before connecting wallets, and organizations should update blocklists to include this domain and its associated IP address.