resolvernode[.]web[.]app

Analysis of resolvernode.web.app, observed on 23 July 2026, indicates that the domain is currently offline, returning HTTP 404 with the page title “Site Not Found”. The site was hosted on Google Firebase, as evidenced by the presence of Firebase infrastructure and an SSL certificate issued by Google Trust Services (WR4). HSTS and HTTP/3 are enabled, confirming modern web security settings. DNS resolution points to IP address 199.36.158.100, which belongs to Fastly, Inc. (AS54113) and is geolocated in the United States. The domain appears on five independent security blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, all of which categorize it as a crypto‑related scam.

VirusTotal analysis shows that 14 of 95 scanning engines flagged the domain, reinforcing the malicious assessment. Registration information reveals that the domain was provisioned through Google Firebase, a common vector for rapid deployment of fraudulent pages. The combination of a Firebase‑hosted site, a valid Google SSL certificate, and the “Crypto Scam” label suggests an attempt to lend legitimacy to a phishing campaign targeting cryptocurrency users. Because the site is offline, direct content cannot be examined, and the exact phishing payload or lure remains unknown.

Nevertheless, the observable infrastructure—Firebase hosting, Fastly CDN, and inclusion on multiple blocklists—provides actionable indicators for defenders. Security teams should continue to block the domain at network perimeter, monitor for re‑registration, and add the associated IP address to deny‑list rules. Threat‑intel feeds should be updated with the SSL fingerprint and the list of blocklists that have already flagged the host. Ongoing surveillance of Google Firebase provisioning patterns is advised to detect future replicas that may reuse similar infrastructure.