Is blockdagpresales.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page token-presale landing site hosted as a subdomain on a free static-hosting platform. Its page title invites visitors to "become a part of BlockDAG network" and to "buy BDAG coins and miners." It presents itself as a gateway for purchasing a cryptocurrency and mining hardware during a pre-launch sale. Its apparent business model is soliciting payment or wallet-based participation for a speculative digital asset.

Scam/Impersonation Risk

Multiple independent reputation sources converge on a confirmed blacklist against this domain. A browser-level safe-browsing service classifies it under social engineering, the threat category used for phishing and deceptive-content listings. A clear majority of the security vendors that evaluated it flagged it as malicious, including several tier-one vendors. These detections alone make this a high-risk site for any sensitive interaction, whatever the quality of its technical hygiene. The domain name compounds the concern. It pairs a popular crypto project name with the word "presales" on a shared hosting platform, which is a common pattern for unofficial presale pages that borrow a legitimate project's brand. The evidence does not establish which brand, if any, is being imitated, and it records no conflicting legal identities. The behavioral sandbox did not observe wallet-drainer routines, clipboard hijacking, hidden forms, cloaking, or credential posts to external hosts. The absence of those behaviors does not offset the blacklist, since a listing can reflect payment-diversion or deceptive-presale schemes that never show up in automated runs. The sandbox did record heavy outbound traffic: 38 external fetch requests and 3 external POST requests during page load. That makes it plausible that the page delegates data collection or checkout to third parties. Evidence:

• Homepage: the page title advertises buying BDAG coins and miners through a presale on a free-hosting subdomain, a high-risk archetype for impersonation-style presale campaigns.
• Homepage reputation check: 12 vendors rated the domain malicious and 1 rated it suspicious. The safe-browsing service returned a social-engineering match, and a confirmed external blacklist is present.
• Homepage behavior: 3 of 3 sandbox runs succeeded with HTTP 200, 38 external fetch requests and 3 external POSTs were logged (up to 86.2% of traffic to external hosts in a single run), and no wallet-drainer, clipboard-write, or hidden-form activity was detected.
• Web archive: 15 snapshots spanning 2024–2026 (about 3 years tracked, first seen June 2024), with domain continuity of roughly 2.4 years, so the presale page has persisted for years rather than appearing briefly.

Regulatory Verification Notes

The captured page does not link a licensed financial entity, a named operator, or a regulatory registration to the offer. No third-party regulatory source confirms the site, and no broker-reputation record matches it. Operator identity could not be independently connected to any real-world company or person. Selling a crypto asset and mining equipment to the public is an activity that normally calls for a visible issuer, terms of sale, and applicable securities or virtual-asset registrations. Without these, the presale cannot be treated as a compliant offering. The page was captured and its text read, but the content analysis could not tie the site to a verified brand, so the identity question stays open. The technical profile is ordinary and does not support legitimacy: the certificate is valid and the hosting is mainstream, but both are available to any site on this platform, including malicious ones. Evidence:

• Homepage: no named issuer, licensing statement, or registration reference accompanies the presale offer.
• Transport layer: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-12-12, which proves control of the hostname but nothing about the operator.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Third-party registry check: no broker or regulatory-database match was found for this site, and no DeFi-protocol listing recognizes it.

What to Verify Next

Anyone who encountered this page through an advertisement, social post, or message should compare it against the official BlockDAG project channels reached independently, not through this page's links. In particular, check whether the project itself acknowledges this presale address. Any payment destination or wallet address shown here should be matched against the official project's published addresses, and purchase should be considered only through channels the project itself confirms. Where an organization needs to assess exposure, it should also review whether any user has already connected a wallet, entered details, or sent funds, and should report the address to the relevant anti-phishing and platform abuse desks. Official contact and support channels should be confirmed by an offline or independent route. Evidence:

• Homepage: the title's coin-and-miner purchase offer is the claim to be checked against the official project's own announcements.
• Hosting: the shared-platform subdomain cannot be assumed to belong to the project, so ownership must be established through the official project's channels.
• Reputation: the current blacklist status should be re-checked after any report or takedown, since listings can change.

Summary Verdict

The site sits in a critical risk posture. Confirmed blacklist findings from several independent sources outweigh its clean transport encryption and stable availability. It should be treated as a probable deceptive presale or impersonation vector until the real project or the platform host disproves that.

Infrastructure Integrity

The site is served entirely through Cloudflare's CDN and WAF. All four observed addresses are edge nodes, and no origin server was observable. The certificate is valid and chains to a recognized issuer. This is a mitigating factor only, because it shows basic operational hygiene and does not vouch for the operator. Edge-only visibility also prevents independent verification of the true hosting origin and can mask rapid content swaps behind the same address. The protective infrastructure cannot offset the reputation findings.

Closing Assessment

The site should not be used for logins, wallet connections, or payments of any kind, and it should be viewed only for read-only inspection. Anyone who has already interacted with it should treat any connected wallet, entered credentials, or sent funds as potentially compromised. They should revoke wallet permissions, change reused passwords, and report the incident.