resolvestring[.]pages[.]dev

Analysis indicates that resolvestring.pages.dev is an active brand impersonation domain targeting Bitcoin users, first observed on March 25, 2026. The domain is hosted on Cloudflare Pages infrastructure and resolves to IP 188.114.96.3, associated with Cloudflare, Inc. in Canada. The page title, 'Open-source, non-custodial, privacy-focused Bitcoin wallet for desktop, that implements trustless coinjoin over the Tor anonymity network,' explicitly mimics terminology associated with legitimate Bitcoin wallet services, suggesting an attempt to deceive users into engaging with fraudulent software or credential harvesting. Infrastructure analysis reveals the domain is currently active, returning an HTTP 200 status, and is secured with an SSL certificate issued by Google Trust Services. The domain appears on one security blocklist and is flagged by two of 94 security vendors in a recent scan. While the exact content and functionality of the site remain unconfirmed, the combination of a Bitcoin-related page title, brand impersonation classification, and low trust scores from independent security assessments indicates a high-risk threat. Defenders should prioritize blocking this domain at the network and endpoint levels, particularly in environments where cryptocurrency-related activity occurs. Monitoring for related domains or subdomains under the pages.dev namespace may help identify additional impersonation attempts. Given the domain's recent creation and active status, continued vigilance is recommended as the campaign may evolve or expand.