purchase2-blockdags-networks[.]pages[.]dev

Analysis indicates that the domain purchase2-blockdags-networks.pages.dev is currently offline, returning HTTP 403, and has been flagged by multiple security vendors as a wallet/seed phishing operation. The page title observed before takedown read "BlockDAG | Best Crypto ICO | Layer 1 Crypto Presale 2025 Now LIVE!", which aligns with the Token Presale phishing kit identified in the intelligence. The site impersonates the brand "across", suggesting an attempt to lure victims by referencing that brand. Technical inspection shows the domain resolves to the Cloudflare‑owned address 172.66.46.244 located in the United States under ASN 13335.

The SSL certificate is issued by Google Trust Services (WE1), and the site employed HSTS, Google Analytics, and HTTP/3, confirming a modern web stack. VirusTotal scans recorded 13 positive detections out of 93 antivirus engines, and the domain appears on four public blocklists. It has been specifically blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The registrar is listed as Cloudflare, Inc., and the authoritative name servers include adi.ns.cloudflare.com, chris.ns.cloudflare.com, desiree.ns.cloudflare.com, and karl.ns.cloudflare.com.

A Gridinsoft trust score of 0 / 100 further underscores its malicious nature. Because the site is presently inaccessible, the exact content cannot be verified, but the combination of the deceptive title, token‑presale kit, and the high‑confidence detections strongly point to a credential‑stealing campaign targeting cryptocurrency wallets. Defenders should immediately add purchase2-blockdags-networks.pages.dev to network‑level block lists, monitor the associated IP range and Cloudflare name servers for future subdomains, and enforce endpoint protection policies that flag wallet‑seed entry forms. Continuous feed updates from the listed security vendors and regular VirusTotal re‑scans are recommended to capture any re‑hosting attempts.