dapp[.]bgevent[.]cn

This domain, dapp.bgevent.cn, is identified as a crypto drainer operation designed to impersonate legitimate event-based decentralized application (dApp) platforms. Analysis indicates the site employs social engineering tactics, presenting itself under the guise of an "EVENTS" portal to lure users into connecting wallets. While no specific brand impersonation is confirmed, the infrastructure and behavior align with known crypto drainer kits, which execute unauthorized transactions to siphon digital assets from victims' wallets. The use of Vue.js for frontend development and Nginx as the web server suggests a sophisticated setup, likely leveraging modern web technologies to evade detection and enhance user interaction. Technical indicators reveal critical red flags: the domain resolves to IP address 202.95.13.236 and was registered on February 21, 2026, through Web Commerce Communications Limited. VirusTotal detection shows 2 out of 95 security vendors flagging the domain, while it appears on three security blocklists. The domain is also blocked by multiple wallet security providers, including MetaMask and SEAL. Additional infrastructure details include the implementation of HTTP/3 and HTTP Strict Transport Security (HSTS), which, while typically security-enhancing, are exploited here to lend an air of legitimacy to the malicious site. The Gridinsoft trust score of 0/100 further underscores its high-risk nature. As of the latest assessment, dapp.bgevent.cn has been taken offline, likely in response to security community actions or hosting provider intervention. However, the elevated risk persists due to the domain's recent creation date and the potential for re-emergence under a different infrastructure. Users who interacted with the site are advised to immediately revoke any connected wallet permissions, transfer assets to a new wallet, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. Continuous monitoring of related domains registered through the same registrar is recommended to preempt similar threats.