dappstonsnodes-1u6[.]pages[.]dev

This domain is actively targeting cryptocurrency users through a crypto drainer scheme designed to empty digital wallets. The site mimics Dapps Node, a legitimate blockchain infrastructure provider, to deceive victims into connecting their wallets. Once connected, malicious scripts automatically initiate unauthorized transactions, transferring funds to attacker-controlled addresses without user consent. The threat is particularly dangerous for users of decentralized applications (dApps) who may mistake the site for an official node service or staking portal. Analysis indicates the domain was registered on October 9, 2025, through Cloudflare, Inc., and is hosted on infrastructure belonging to the same provider (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common pattern in phishing sites leveraging legitimate CDN services. Despite zero detections in VirusTotal’s 95-engine scan, the domain appears on four security blocklists, including those maintained by Polkadot and Enkrypt, which specialize in blockchain threats. The page title, 'Dapps Node,' further confirms the impersonation attempt, while the IP address 188.114.96.3 resolves to Cloudflare’s network, a frequent host for newly deployed phishing infrastructure. If you visited dappstonsnodes-1u6.pages.dev and connected a wallet, immediately disconnect it from all dApps and revoke any active session permissions. Check your wallet’s transaction history for unauthorized transfers and move remaining funds to a new, secure wallet. Monitor connected accounts for suspicious activity and enable transaction alerts if available. Users should also report the domain to their wallet provider and consider filing a complaint with their local cybercrime unit. To prevent future exposure, verify domain authenticity through official sources before interacting with any blockchain service.