dexnoderesolver[.]pages[.]dev

PhishDestroy has identified dexnoderesolver.pages.dev as a generic phishing threat targeting the cryptocurrency community. The site, titled 'Web 3 - Web3 crypto website,' was designed to impersonate a legitimate Web3 platform, likely aiming to steal login credentials or trick users into connecting their wallets to a malicious smart contract. Although no specific drainer kit has been confirmed, the site's structure suggests it could deploy a crypto drainer upon wallet connection. This domain was registered through Cloudflare, Inc. on April 15, 2026, and resolved to IP address 172.66.47.158. Despite being flagged on one security blocklist, VirusTotal reported zero detections out of 95 scans, indicating that traditional security vendors had not yet identified the threat. The domain's SSL certificate was issued by Google Trust Services under the WE1 certificate authority, adding a false sense of legitimacy.

At the time of analysis, the domain has been taken offline, rendering it inaccessible. This takedown likely resulted from reporting to the hosting provider or registrar. However, the risk remains that the same threat actor may deploy similar domains using different names or subdomains. Users who may have interacted with the site should immediately revoke any wallet approvals and change passwords for related accounts. PhishDestroy advises all crypto users to verify the authenticity of any Web3-related site before connecting their wallets, especially those with unusual domain names like 'dexnoderesolver.pages.dev.' Always double-check URLs and use trusted sources to access decentralized applications.