blockdagnetworks-swap[.]pages[.]dev

This domain, blockdagnetworks-swap.pages.dev, is flagged as a generic phishing site impersonating BlockDAG, a decentralized exchange (DEX) platform. Analysis indicates the site mimics legitimate swap interfaces to deceive users into entering wallet credentials or approving malicious transactions, likely deploying a cryptocurrency drainer kit to siphon funds. The page title, 'BlockDAG - Swap DEX,' directly aligns with the targeted brand, increasing the likelihood of successful social engineering attacks against cryptocurrency holders. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to IP address 172.66.47.93 and was registered through Cloudflare, Inc., with a creation date of March 31, 2026—an anomalous future date suggesting domain spoofing or misconfiguration. VirusTotal reports 12 out of 95 security vendors flagging the domain, while it appears on one security blocklist and is assigned a trust score of 0/100. The site employs HSTS, Cloudflare CDN, and HTTP/3, which may be leveraged to obfuscate malicious traffic or evade detection. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and fraudulent sites. The domain is currently offline, likely taken down following detection by security systems. However, residual risk remains for users who may have interacted with the site prior to its removal, particularly if wallet credentials or private keys were exposed. Organizations and individuals are advised to monitor for unauthorized transactions, revoke any suspicious token approvals, and verify the legitimacy of DEX platforms before engaging. The anomalous domain creation date and future timestamp further underscore the need for heightened scrutiny of cryptocurrency-related infrastructure.