dagz[.]pages[.]dev

This domain is flagged as an active crypto presale scam targeting users with fraudulent investment opportunities. Analysis indicates the site impersonates a legitimate cryptocurrency presale platform, likely designed to harvest wallet credentials or deploy token-draining malware. The threat type aligns with recent trends in blockchain-based financial fraud, where attackers exploit FOMO (fear of missing out) to trick victims into connecting wallets or sending funds to malicious contracts.

Infrastructure analysis reveals the domain dagz.pages.dev was registered on October 15, 2024, through Cloudflare Pages, a platform frequently abused for rapid deployment of phishing sites. The domain resolves to the IP address 188.114.97.3, a Cloudflare-hosted endpoint with no prior malicious associations in public threat feeds. As of the latest scan, the site has 0 detections out of 95 security engines on VirusTotal, indicating low initial visibility. However, it appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which may contribute to the site's superficial legitimacy.

Mitigation requires immediate action from both users and security teams. Users are advised to avoid interacting with the site, particularly any prompts to connect cryptocurrency wallets or participate in presale events. Wallet connections should be revoked for any contracts associated with this domain, and funds should be monitored for unauthorized transactions. Security teams should prioritize blocking the domain and IP at the network perimeter, while also alerting users to the risks of crypto presale scams. Given the domain's recent registration and low detection rate, proactive monitoring of Cloudflare Pages for similar infrastructure is recommended to identify emerging threats.