appnodesrefix[.]pages[.]dev

The domain appnodesrefix.pages.dev is identified as a generic phishing site specializing in fraudulent RPC-Dapps wallet interfaces. Analysis confirms this domain was actively used to deceive cryptocurrency users by mimicking legitimate decentralized application (dApp) remote procedure call (RPC) endpoints. Currently, the domain has been taken offline, though prior activity indicates elevated risk for credential harvesting and wallet compromise. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered through Cloudflare, Inc. on April 11, 2026, with an SSL certificate issued by Google Trust Services (WE1). It resolves to the IP address 172.66.44.183 and appears on three distinct security blocklists. VirusTotal reports that 6 of 95 security vendors flagged this domain as malicious, while the page title explicitly reads RPC-Dapps, reinforcing its fraudulent theme. The combination of recent registration, Cloudflare hosting, and blocklist presence suggests deliberate evasion of detection mechanisms. Current status indicates the domain is offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and IP address at the network level, revoke any credentials potentially exposed through this site, and monitor for unauthorized transactions. Cryptocurrency users should verify RPC endpoints directly through official project documentation and avoid interacting with unsolicited dApp interfaces. Security teams should treat any prior connections to this domain as a potential compromise indicator.