dappschainresolve[.]live

Analysis of dappschainresolve.live indicates an active phishing domain targeting decentralized application (dApp) users, currently under investigation. The domain was registered on July 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with newly established phishing infrastructure. It resolves to IP address 172.67.142.16, hosted on Cloudflare nameservers bethany.ns.cloudflare.com and lennox.ns.cloudflare.com, a common pattern used to obscure hosting origins and evade IP-based blocking. As of July 20, 2026, the domain remains active and is flagged on one security blocklist, specifically by PhishDestroy, though it has not been widely detected across detection platforms. VirusTotal scans conducted by 95 vendors show zero current detections, though this absence does not confirm safety or legitimacy. The domain’s content and specific threat mechanics remain unconfirmed; no brand target, phishing kit, or page title has been identified in available intelligence. The domain name suggests a focus on dApp credential harvesting, potentially mimicking legitimate blockchain resolution or wallet services, though no direct evidence of such targeting is currently available. Defenders should treat this domain as a potential credential theft vector within decentralized finance or Web3 ecosystems. Infrastructure analysis reveals the use of Cloudflare DNS and likely CDN services, which may complicate origin tracing and takedown efforts. The domain’s recent creation, combined with its presence on a specialized blocklist, supports the assessment of active malicious intent. Organizations are advised to monitor network traffic to 172.67.142.16 and apply domain-based blocking where appropriate, pending further analysis of payload delivery or user interaction patterns.