blockdagclaimhub[.]pages[.]dev

blockdagclaimhub.pages.dev was observed hosting a page titled “Blockdag Claim Hub” that directly references the BlockDAG brand. The domain was created on 10 March 2026 and resolves to the Cloudflare IP 172.66.47.169, which belongs to ASN 13335 and is located in the United States. DNS resolution uses the Cloudflare authoritative nameservers davina.ns.cloudflare.com and glen.ns.cloudflare.com, confirming that the attacker leveraged Cloudflare’s free hosting platform. The site employed HTTPS with HSTS and HTTP/3 but presented no valid SSL certificate, suggesting the use of a default or self‑signed certificate. VirusTotal recorded two positive detections out of ninety‑four scanners, and the domain is listed on the PhishDestroy and ScamSniffer blocklists.

Both blocklists classify the site as a crypto‑related scam, consistent with the “Crypto Scam” label in the intelligence. The page title explicitly invokes a claim‑hub concept, indicating an attempt to persuade BlockDAG users to submit private keys or other credentials. The domain is currently taken offline, and no further content is reachable for verification. Uncertainty remains regarding the exact payload or credential‑harvesting mechanism, as no page content or network traffic captures have been published. Additionally, the absence of a signed SSL certificate prevents verification of any certificate pinning that might have been used to bolster trust.

Analysts should therefore treat the domain as a confirmed brand‑impersonation vector and incorporate it into domain‑blocking policies across perimeter firewalls, DNS filtering services, and secure web gateways. Continuous monitoring of the pages.dev namespace for newly registered subdomains containing “blockdag” or similar claim‑hub phrasing is recommended, as the infrastructure suggests the operator can rapidly recreate a clone using the same hosting provider. Coordination with Cloudflare abuse channels may facilitate takedown if the domain resurfaces.