donk-meme[.]pages[.]dev

Analysis of donk-meme.pages.dev shows an active infrastructure associated with a high‑risk crypto scam. The domain resolves to 172.66.46.224, a Cloudflare‑owned address located in Canada, and is hosted on Cloudflare Pages. TLS termination uses a Google Trust Services certificate (WE1), indicating a valid HTTPS service. The page title returned by the server is "Donk.Meme - PreSale Page," suggesting a pre‑sale offering likely tied to cryptocurrency. Front‑end libraries identified include Bootstrap, jQuery, Unpkg, SweetAlert2, OWL Carousel, jsDelivr, HSTS, and crypto‑js, all common in modern web applications and not indicative of malicious code on their own. Threat intelligence flags the domain on two security blocklists (PhishDestroy, Enkrypt) and records three detections out of 91 VirusTotal scanners, reinforcing the suspicion of malicious activity. The Gridinsoft trust score is 0 / 100, indicating the site is considered entirely untrustworthy by that engine. While the exact payload or phishing lure has not been observed, the combination of a crypto‑related title, low trust scores, blocklist presence, and high‑risk classification warrants immediate defensive actions. Organizations should block the domain at perimeter firewalls and DNS filtering layers, ensure endpoint protection solutions are updated to flag the host, and monitor for any related command‑and‑control traffic. Continuous re‑evaluation is advised as new artifacts may emerge.