blockdagnetworks-swaps[.]pages[.]dev

The domain blockdagnetworks-swaps.pages.dev has been identified as a crypto drainer infrastructure impersonating the BlockDAG decentralized exchange platform. This threat specifically targets cryptocurrency users by mimicking legitimate swap services to facilitate unauthorized token transfers from victims' wallets. As of the latest verification, the domain has been taken offline, though prior activity remains a documented risk. Analysis indicates this domain was flagged by 13 of 95 security vendors on VirusTotal, reflecting moderate detection coverage. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 10, 2026, with a Let's Encrypt SSL certificate providing HTTPS encryption. The domain resolved to IP address 172.66.44.118 and appeared on one security blocklist prior to its deactivation. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The page title, 'BlockDAG - Swap DEX,' directly impersonates the legitimate BlockDAG brand to lend credibility to the fraudulent service. Current status confirms the domain is offline, though residual risk persists for users who may have interacted with it during its active period. Organizations and individuals are advised to monitor wallet addresses for unauthorized transactions and revoke any connected smart contract approvals associated with this domain. Network defenders should update blocklists to include the domain and its resolved IP address. Cryptocurrency users are urged to verify swap service URLs through official project channels and employ hardware wallets or isolated browser sessions for high-value transactions. Proactive threat hunting for related infrastructure, such as similarly named subdomains or Cloudflare-hosted pages, is recommended to identify potential follow-on campaigns.