purchase2-blockdag[.]pages[.]dev

PhishDestroy identifies purchase2-blockdag.pages.dev as an active banking phishing domain luring users with BlockDAG branding. The page masquerades as a legitimate purchase portal while deploying a drainer kit to harvest cryptocurrency and sensitive credentials. This domain weaponizes social engineering tactics through a spoofed interface designed to mimic BlockDAG’s official ecosystem, tricking visitors into authorizing fraudulent transactions.

Technical indicators confirm high-risk compromise: VirusTotal analysis reveals a detection ratio of 14/95 security vendors, while Google Safe Browsing classifies the site under SOCIAL_ENGINEERING. The domain operates under Cloudflare’s registrar infrastructure, resolving to IP 172.66.44.167 via a Google Trust Services-issued SSL certificate. Security research confirms the domain has been flagged by at least two public blocklists and blocked by Enkrypt and ScamSniffer, highlighting its malicious reputation.

Current status shows the domain remains active and unresolved despite multiple detections, posing an ongoing threat to unprotected users. Immediate action is recommended: block network traffic to 172.66.44.167 and the domain itself, revoke any unauthorized crypto transaction approvals, and audit browser extensions for injected scripts. Remaining risk is high due to the drainer’s ability to bypass some endpoint defenses, emphasizing the need for layered security controls including DNS filtering and user awareness training.