appconfigresolve[.]pages[.]dev

This domain, appconfigresolve.pages.dev, is flagged as a crypto drainer operation designed to compromise cryptocurrency wallets through RPC-Dapps impersonation. Analysis indicates the site mimics decentralized application (dApp) interfaces, likely exploiting RPC endpoints to execute unauthorized transactions or drain funds from connected wallets. The page title, 'RPC-Dapps,' aligns with known tactics used in wallet-draining attacks, where victims are tricked into interacting with malicious smart contracts or signing harmful transactions. Infrastructure analysis reveals the following technical indicators: the domain is registered through Cloudflare, Inc., with a creation date of March 14, 2026, suggesting a recently deployed malicious asset. It resolves to the IP address 188.114.97.3, a Cloudflare-hosted endpoint, and is currently flagged by 6 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, further confirming its malicious nature. The SSL certificate is issued by Let’s Encrypt, a common choice for threat actors due to its accessibility and short-lived validity periods. Technologies detected include Bootstrap, HSTS, and HTTP/3, which are often leveraged to lend legitimacy to phishing pages. The domain is currently offline, likely due to takedown efforts or voluntary suspension by the hosting provider. However, residual risk remains, as threat actors may redeploy the infrastructure under a new domain or subdomain. Users who interacted with this domain should immediately revoke any connected wallet permissions, audit transaction histories for unauthorized activity, and monitor for further phishing attempts. Organizations are advised to block the domain and associated IP address in network security controls to prevent access. Given the elevated risk, continuous monitoring of related infrastructure is recommended to detect potential resurgence or evolution of this threat.