dappsrestore[.]web[.]app

This domain is flagged as a high-risk crypto drainer phishing site targeting users of Ethereum Virtual Machine (EVM) wallets. Analysis indicates the site employs deceptive tactics to trick victims into connecting wallets, enabling unauthorized transactions that drain cryptocurrency assets. The page title, 'EVM Resolve,' suggests an attempt to impersonate legitimate EVM-related services or recovery tools, a common tactic in crypto drainer schemes. Infrastructure analysis reveals the domain was registered through Google LLC on April 27, 2026, and resolves to the IP address 199.36.158.100, hosted in the United States under Google LLC infrastructure. VirusTotal detection shows 1 out of 95 security vendors have flagged the domain, while it appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Google Trust Services (WR4), a legitimate provider often exploited by threat actors to lend credibility to malicious domains. The domain remains active as of this report. Mitigation steps for this specific threat type include immediate blocking of the domain across network security controls, particularly in environments where cryptocurrency transactions occur. End-users should be educated to verify domain authenticity before connecting wallets, especially for sites claiming to offer recovery or resolution services. Wallet providers are advised to integrate real-time blocklist checks to prevent interactions with known malicious domains. Additionally, monitoring for similar domains registered under Google LLC or resolving to the same IP range may help identify related threats.