cpcalendars[.]dapp-auth[.]com

This domain, cpcalendars.dapp-auth.com, is flagged as a generic phishing threat with an elevated risk level. Analysis indicates it is designed to mimic decentralized application (dApp) authentication portals, likely targeting cryptocurrency wallet users to harvest credentials or private keys. The subdomain structure (cpcalendars) suggests an attempt to impersonate calendar or synchronization services, a common tactic in phishing campaigns aimed at users of blockchain platforms. No specific brand or drainer kit signatures were identified, but the domain’s infrastructure aligns with known phishing patterns observed in the cryptocurrency ecosystem. Infrastructure analysis reveals the following technical indicators: the domain was registered on October 21, 2025, through OwnRegistrar, Inc., and resolves to the IP address 192.3.190.187, hosted on AS36352 (HostPapa, US). It lacks an SSL certificate, increasing the likelihood of interception or tampering during data transmission. The domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, with detections including phishing, fraud, and suspicious behavior. The page title, '403 Forbidden,' suggests the domain may have been taken offline or is configured to restrict access, potentially to evade detection or analysis. As of the latest assessment, cpcalendars.dapp-auth.com is offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated. Users who interacted with this domain should assume credential compromise and take immediate action, including revoking wallet permissions, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include the domain and its associated IP (192.3.190.187) to prevent future access. The elevated risk level persists due to the domain’s registration status and historical malicious activity, warranting continued vigilance.