blockdagpurchase[.]pages[.]dev

blockdagpurchase.pages.dev is a Cloudflare‑hosted domain created on 25 May 2025 that was used to deliver a wallet/seed phishing campaign targeting Coinbase users. The site was accessible via HTTPS, supported HTTP/3, and loaded third‑party scripts from jsDelivr, Google Tag Manager, Google Analytics, and Facebook Pixel. HSTS was observed, indicating the domain enforced secure connections. The page title presented to visitors was “Become a Part Of BlockDAG Network | Buy BDAG Coins & Miners”, which does not reference Coinbase but the underlying campaign was classified as brand impersonation because the operator collected Coinbase wallet credentials. The domain resolves to 172.66.44.195, an address owned by AS13335 Cloudflare, Inc., located in the United States.

DNS is served by aleena.ns.cloudflare.com and howard.ns.cloudflare.com. An HTTP request returned status 403, suggesting the content is no longer publicly served; the current status is marked as offline and the site has been taken down. Detection hygiene shows that 15 of 94 security vendors on VirusTotal flagged the domain as malicious. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0 / 100, reinforcing the assessment of high risk.

No SSL certificate anomalies were reported beyond the use of Cloudflare’s default TLS. The registration record lists Cloudflare, Inc. as the registrar, with no evidence of further obfuscation. While the exact phishing landing page content has not been captured, the combination of brand impersonation, wallet/seed phishing, low trust score, and multiple vendor detections establishes a high‑confidence malicious profile. Defenders should continue to block the IP 172.66.44.195 at network perimeters, add the domain to internal URL blocklists, and monitor for new domains that resolve to the same Cloudflare‑managed ASN or reuse the “blockdagpurchase” naming pattern.