dawnpresale[.]xyz

This domain is flagged as an elevated-risk brand impersonation threat targeting Discord users through a fraudulent DAWN token presale and airdrop scheme. Analysis indicates the site operates as a phishing kit designed to harvest credentials and cryptocurrency wallet information under the guise of a legitimate token distribution event.

Infrastructure analysis reveals the domain was registered on November 02, 2025, through Ultahost, Inc., and resolves to the IP address 45.12.2.67. Security telemetry shows the domain appears on one blocklist, with a Scamadviser trust score of 1/100. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while the page title explicitly promotes "DAWN Token Presale & Airdrop — User-Owned Broadband Network." The domain has since been taken offline, though residual risk may persist through cached or mirrored instances.

Mitigation steps for this threat type include blocking the domain and associated IP (45.12.2.67) at the network perimeter, as well as implementing email and web filtering rules to prevent delivery of related phishing lures. Users who interacted with the site should revoke any connected wallet permissions, rotate credentials for Discord and associated cryptocurrency accounts, and monitor for unauthorized transactions. Security teams are advised to correlate this domain with known airdrop scam indicators, including the use of urgency-driven language and fake token presale promises, to detect similar campaigns.