# PhishDestroy threat dossier — bdag.club ================================================================ Fetched: 2026-06-29 09:17:10 UTC Canonical: https://phishdestroy.io/domain/bdag.club/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Generic Phishing Phishing kit: Token Presale ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Gridinsoft, SOCRadar AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.67.159.145 (US, San Francisco) ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Hosting org: AS13335 Cloudflare, Inc. Registrar: TLD Registrar Solutions Ltd. Nameservers: ezra.ns.cloudflare.com, rihana.ns.cloudflare.com Registered: 2024-04-05 Expires: 2027-04-05 Page title: BlockDAG | Layer 1 Presale Now LIVE! ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-08-11 Status: INVALID chain Fingerprint: 410a31ab7a000040b6b404266e5a2bb2b4f433b696ba2a2ce4095ffbcf7a8d9a ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2024-04-05 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-10 23:18:48 UTC (by PhishDestroy tracker) First reported: 2026-06-10 21:21:06 UTC (abuse notice filed) Last verified: 2026-06-29 08:20:35 UTC Neutralised: 2026-06-14 00:46:00 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019eb365-f9af-76e0-8522-0f5fdfcc48cc/ URLQuery: https://urlquery.net/report/2a872de2-f5ab-4b68-ad78-976d4508fa7c Wayback Machine: https://web.archive.org/web/*/bdag.club crt.sh CT logs: https://crt.sh/?q=%25.bdag.club Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=bdag.club AlienVault OTX: https://otx.alienvault.com/indicator/domain/bdag.club URLhaus: https://urlhaus.abuse.ch/host/bdag.club/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-26 00:05:38 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, bdag.club, is identified as a cryptocurrency presale phishing site specifically impersonating BlockDAG, a Layer 1 blockchain project. The domain currently holds an offline status but was actively used to deceive investors by promoting a fraudulent token presale under the guise of a legitimate blockchain offering. Analysis indicates the site employed social engineering tactics, including a fabricated presale countdown and investment urgency, to exploit victims seeking early access to cryptocurrency investments. Infrastructure analysis reveals the domain was registered on April 05, 2024, through TLD Registrar Solutions Ltd. It resolved to the IP address 172.67.159.145 and utilized an SSL certificate issued by Google Trust Services, a common tactic to appear legitimate. The domain is flagged by 4 of 95 security vendors on VirusTotal and appears on one security blocklist. Gridinsoft assigned a trust score of 0 out of 100, and AlienVault OTX includes the domain in two threat intelligence pulses. The page title, 'BlockDAG | Layer 1 Presale Now LIVE!', directly mimics the branding of the legitimate BlockDAG project to enhance credibility. The domain has since been taken offline, but the threat remains relevant due to the potential for re-emergence under similar infrastructure or branding. Organizations and individuals are advised to monitor for newly registered domains impersonating cryptocurrency projects, particularly those leveraging presale or investment urgency themes. Blocklisting the domain and associated IP address (172.67.159.145) is recommended for network-level protection. Users should verify cryptocurrency investment opportunities through official project channels and avoid interacting with unsolicited presale promotions. Security teams are encouraged to review logs for connections to the domain or IP to identify potential prior exposure. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260610-11BCE6 Favicon MD5: ab0d413aab2b79c3d595232743c12f48 TLS cert SHA-256: 410a31ab7a000040b6b404266e5a2bb2b4f433b696ba2a2ce4095ffbcf7a8d9a ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/bdag.club/ JSON API: https://api.destroy.tools/v1/check?domain=bdag.club Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,428 domains (13,714 alive under monitoring, 158,147 confirmed takedowns/dead). Site: https://phishdestroy.io