blockdag-server[.]web[.]app

The domain blockdag-server.web.app has been identified as a brand‑impersonation site targeting the BlockDAG ecosystem. Registration records show the domain was created through Google LLC, and the hosting environment is confirmed to be Firebase, with the site delivering content over HSTS‑enabled HTTP/3 connections. The TLS certificate presented is issued by Google Trust Services under the WR4 designation, which is typical for Firebase‑hosted applications. Network resolution points to the IP address 199.36.158.100, an address owned by Fastly, Inc. (ASN 54113) and geolocated to the United States.

Scanning by VirusTotal produced detections from three of ninety‑five security vendors, indicating that at least a subset of scanners recognize malicious characteristics. The domain currently appears on a single security blocklist and has been actively blocked by PhishDestroy, reinforcing its classification as a malicious resource. An HTTP request to the site returns a 404 status, and the page title retrieved—"BlockDAG | Best Crypto ICO | Layer 1 Crypto Presale 2025 Now LIVE!"—matches the token‑presale phishing kit associated with cryptocurrency initial‑coin‑offering scams. The combination of a brand‑specific page title, the use of a known token‑presale kit, and the presence of multiple vendor detections provides concrete evidence of intentional brand impersonation.

Uncertainty remains regarding any residual infrastructure that may become active if the domain is re‑hosted, as the current 404 response suggests the site is offline but could be re‑instated. Defenders should therefore proactively block DNS resolution for blockdag-server.web.app, add the IP address 199.36.158.100 to network‑level deny lists, and monitor for new Firebase or Fastly‑hosted domains that reference BlockDAG or similar token‑presale language. Continuous re‑scanning with multi‑vendor services is advised to capture any changes in detection status.