resolvedexnode[.]online

Analysis of the domain resolvedexnode.online shows a newly registered web address created on 21 February 2026 that was actively serving content before being taken offline. The site presented the page title “Decentralized Dapps – We are unifying Web3 by providing best‑in‑class, self‑custodial, and multichain support,” indicating a focus on cryptocurrency and decentralized application services, consistent with the classified crypto‑scam category. Infrastructure investigation reveals that the domain resolved to IP 23.254.227.225, an address hosted in the Netherlands and assigned to AS54290 (Hostwinds LLC). The TLS certificate in use was issued by cPanel, Inc. Certification Authority, a generic hosting‑provider certificate rather than a brand‑specific or extended‑validation credential.

The domain appears on three external blocklists and has been flagged by the PhishDestroy, ScamSniffer, and Enkrypt monitoring services, confirming its malicious reputation across multiple independent feeds. VirusTotal records indicate that the domain was scanned by 95 security vendors, none of which raised a detection at the time of analysis; this absence of alerts does not constitute evidence of benign behavior. Current status is offline, and the risk level remains under investigation, reflecting limited open‑source intelligence beyond the observed infrastructure and blocklist entries.

Uncertainties include the exact payload delivered to victims, the presence of any credential‑harvesting forms, and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the host. Defenders should continue to block the resolved IP address and domain across perimeter defenses, monitor for any re‑activation or related subdomains, and incorporate the observed indicators—domain name, IP, SSL issuer, and page title—into threat‑intel feeds.