app-blocksdag[.]biz

Analysis of app-blocksdag.biz indicates the site was provisioned on 21 February 2026 through Global Domain Group LLC and pointed to the IPv4 address 104.168.69.100. The IP is advertised as belonging to HostPapa (AS36352) and resides in the United States. Both authoritative name servers are Cloudflare (lloyd.ns.cloudflare.com, monika.ns.cloudflare.com), which is consistent with a CDN‑based hosting pattern often used to conceal malicious infrastructure. The domain presents no TLS certificate, leaving the HTTP connection unencrypted and exposing any credential capture to network eavesdropping. The only content observed before the site was taken offline was a page title reading “Communication Protocol for Web3”, which aligns with the listed scam type of “Crypto Scam”.

No additional page content, login forms, or redirects have been captured, so the exact phishing mechanism remains unknown. However, the combination of a crypto‑focused title, lack of encryption, and recent registration strongly suggests an attempt to lure victims into providing wallet keys or sending cryptocurrency. Reputation services flag the domain heavily. Gridinsoft assigns a zero‑score trust rating (0/100). VirusTotal reports five detections out of ninety‑three scanners, and the domain appears on seven independent blocklists, including PhishDestroy, MetaMask, ScamSniffer, Polkadot, and SEAL, confirming consensus across multiple anti‑phishing feeds.

The site’s current HTTP status is offline, indicating that the operator has removed the front‑end, but the underlying infrastructure may be reused for future campaigns. Defenders should continue to block the domain and the associated IP address at network perimeter devices. Automated URL filtering should reference the listed blocklists, and endpoint protection solutions should be updated with the VirusTotal detection signatures.