Search tracked domains and review stored evidence, detections, and the latest observed availability.

195,987
Total Tracked
195,987
VT Detected
89,032
Last Seen Active
108,303
Unavailable at Last Check
0
VT Pending
Fake Token Presale
HIGH THREAT

Understanding and Mitigating Fake Token Presale Threats

PhishDestroy currently associates 237 tracked domain reports with Fake Token Presale. Review stored detections, evidence, and the latest observed availability below.

237
Domains Detected
HIGH
Threat Level

How This Attack Works

Fake Token Presale scams trick victims into believing they are investing in legitimate cryptocurrency projects. Here's how the scam typically unfolds:

STEP 1
Create Fake Websites
Scammers set up realistic-looking websites mimicking legitimate token presale portals.
STEP 2
Promote Presale on Social Media
Using social media and fake endorsements, scammers attract potential investors.
STEP 3
Collect Cryptocurrency
Victims are prompted to send cryptocurrency to a specified address under the guise of buying tokens.
STEP 4
Disappear with Funds
Once funds are collected, scammers shut down the site and disappear, leaving victims without recourse.

Technical Analysis

Fake Token Presale scams often leverage phishing tactics combined with cryptocurrency-specific techniques. Attackers use homograph attacks to create URLs that closely resemble legitimate sites, often registered through top registrars like NICENIC INTERNATIONAL GROUP CO., LIMITED and PDR Ltd. d/b/a PublicDomainRegistry.com. They exploit the decentralized nature of blockchain networks, utilizing smart contracts that mimic legitimate presale contracts but are programmed to divert funds to the attacker’s wallet. The infrastructure often involves cloud-based hosting services to quickly deploy and dismantle sites, minimizing the chance of detection. HTML and JavaScript are commonly used to create dynamic, convincing interfaces that reassure potential victims of the site’s legitimacy. Additionally, attackers might deploy SEO techniques to improve the visibility of their fraudulent sites in search engine results, further increasing their reach.

Real Cases

CryptoX Presale Scam (2024)
$2 million stolen
A fake presale for a non-existent token, CryptoX, duped investors into contributing significant sums.
TokenLaunch Fraud (2023)
$1.5 million stolen
Victims were lured into a fake token launch with promises of high returns, only for the site to vanish post-collection.
QuickCoin Deception (2024)
$3 million stolen
Scammers created a sophisticated site mimicking a known exchange, leading to substantial financial losses.

How to Detect

Check for slight misspellings in domain names.
Look for inconsistent branding or layout compared to legitimate sites.
Be wary of unsolicited investment opportunities via social media.
Verify presale details on official project channels.
Beware of high-pressure tactics urging immediate investment.

How to Protect Yourself

1 Always verify URLs before entering personal information.
2 Use browser extensions to detect phishing attempts.
3 Consult official project websites or channels for presale information.
4 Enable two-factor authentication on cryptocurrency exchanges.
5 Report suspicious sites to authorities and platforms like PhishDestroy.

Frequently Asked Questions

What is Fake Token Presale?
Fake Token Presale is a scam where attackers create fraudulent cryptocurrency presale websites to deceive investors into sending funds for non-existent tokens.
How much money has been stolen through Fake Token Presale?
Millions have been lost to Fake Token Presale scams, with documented cases like CryptoX and QuickCoin resulting in over $6 million in damages.
How do I protect myself from Fake Token Presale?
Verify presale details on official channels, scrutinize website URLs for discrepancies, and use security tools to detect phishing attempts.
What should I do if I'm a victim of Fake Token Presale?
Report the scam to law enforcement, notify your cryptocurrency exchange, and share information with platforms like PhishDestroy to help prevent further incidents.
Data sourced from PhishDestroy threat intelligence database — 237 domains tracked for this threat type
Token Presale — Threat Intelligence Kit High Threat
237
Domains
139
Alive
61
Taken Down
7.1
Avg VT
58.6%
Alive Rate
98.3%
Detected
Since Jul 2025 140 domains with VT ≥ 5
Fake Token Presale 237 domains
Screenshot of binance-dep30h.com
binance-dep30h.com
23 VTUnknownBinance
Screenshot of binance-dep30h.com
binance-dep30h.com
Screenshot of dreamsmart.pl
dreamsmart.pl
17 VTUnknownAngel Drainer
Screenshot of dreamsmart.pl
dreamsmart.pl
Screenshot of liquidchains.info
liquidchains.info
17 VTUnknownAngel Draineracross
Screenshot of liquidchains.info
liquidchains.info
Screenshot of trdnetwork.info
trdnetwork.info
17 VTActivegenericcrypto
Screenshot of trdnetwork.info
trdnetwork.info
Screenshot of baforth.guru
baforth.guru
16 VTActiveAngel Drainer
Screenshot of baforth.guru
baforth.guru
Screenshot of claims-bitcoinhyper.com
claims-bitcoinhyper.com
16 VTUnknownAngel DrainerEthereum
Screenshot of claims-bitcoinhyper.com
claims-bitcoinhyper.com
Screenshot of coiniist-rainbow.xyz
coiniist-rainbow.xyz
16 VTUnknownAngel Draineracross
Screenshot of coiniist-rainbow.xyz
coiniist-rainbow.xyz
Screenshot of llittlepepe.com
llittlepepe.com
16 VTActiveAngel Drainergenericcrypto
Screenshot of llittlepepe.com
llittlepepe.com
Screenshot of mbato.guru
mbato.guru
16 VTActiveAngel Drainer
Screenshot of mbato.guru
mbato.guru
Screenshot of monoprotocol.info
monoprotocol.info
16 VTActiveAngel Draineracross
Screenshot of monoprotocol.info
monoprotocol.info
Screenshot of mostgretoko.guru
mostgretoko.guru
16 VTActiveAngel Drainer
Screenshot of mostgretoko.guru
mostgretoko.guru
Screenshot of ripplecareer.com
ripplecareer.com
16 VTActiveXRP
Screenshot of ripplecareer.com
ripplecareer.com
Screenshot of sonami-so.info
sonami-so.info
16 VTActiveAngel Drainersolana
Screenshot of sonami-so.info
sonami-so.info
Screenshot of agaricproku.com
agaricproku.com
15 VTUnknown
Screenshot of agaricproku.com
agaricproku.com
Screenshot of claims-snortertoken.com
claims-snortertoken.com
15 VTUnknownWallet Connect Abusedextools
Screenshot of claims-snortertoken.com
claims-snortertoken.com
Screenshot of hotoj.guru
hotoj.guru
15 VTActiveAngel Drainer
Screenshot of hotoj.guru
hotoj.guru
Screenshot of prizelink.net
prizelink.net
15 VTUnknown
Screenshot of prizelink.net
prizelink.net
Screenshot of blazpay.org
blazpay.org
14 VTActiveAngel Draineracross
Screenshot of blazpay.org
blazpay.org
claim-snortertoken.live
14 VTActive
Screenshot of coinlist-rainbow.xyz
coinlist-rainbow.xyz
14 VTUnknownAngel Drainergenericcrypto
Screenshot of coinlist-rainbow.xyz
coinlist-rainbow.xyz
Screenshot of colnilst.co
colnilst.co
14 VTActive
Screenshot of colnilst.co
colnilst.co
Screenshot of debraleslie.com
debraleslie.com
14 VTActiveApple
Screenshot of debraleslie.com
debraleslie.com
Screenshot of dep29k-binance.com
dep29k-binance.com
14 VTUnknownBinance
Screenshot of dep29k-binance.com
dep29k-binance.com
Screenshot of gro39k.info
gro39k.info
14 VTActiveEthereum
Screenshot of gro39k.info
gro39k.info
Screenshot of invest-xai.com
invest-xai.com
14 VTActive
Screenshot of invest-xai.com
invest-xai.com
Screenshot of moonbull.io
moonbull.io
14 VTActivecelestia
Screenshot of moonbull.io
moonbull.io
Screenshot of pepeheimer.io
pepeheimer.io
14 VTActiveWallet Connect Abuse
Screenshot of pepeheimer.io
pepeheimer.io
Screenshot of retikclaim.web.app
retikclaim.web.app
14 VTActiveWallet Connect Abuseacross
Screenshot of retikclaim.web.app
retikclaim.web.app
Screenshot of xa500k.com
xa500k.com
14 VTUnknown
Screenshot of xa500k.com
xa500k.com
Screenshot of xa60zlaunch.com
xa60zlaunch.com
14 VTUnknownEthereum
Screenshot of xa60zlaunch.com
xa60zlaunch.com
Screenshot of zama.sale
zama.sale
14 VTUnknownbinance
Screenshot of zama.sale
zama.sale
Screenshot of 003-bca.net
003-bca.net
13 VTUnknownAngel DrainerApple
Screenshot of 003-bca.net
003-bca.net
Screenshot of appie.shop
appie.shop
13 VTActiveApple
Screenshot of appie.shop
appie.shop
Screenshot of cradwin.com
cradwin.com
13 VTActivebinance
Screenshot of cradwin.com
cradwin.com
Screenshot of dep26k-binance.com
dep26k-binance.com
13 VTUnknownBinance
Screenshot of dep26k-binance.com
dep26k-binance.com
Screenshot of gr0k2025.com
gr0k2025.com
13 VTActive
Screenshot of gr0k2025.com
gr0k2025.com
Screenshot of grok49k-cointelegraph.com
grok49k-cointelegraph.com
13 VTActive
Screenshot of grok49k-cointelegraph.com
grok49k-cointelegraph.com
Screenshot of myxaicoin.pages.dev
myxaicoin.pages.dev
13 VTActivecryptoscam
Screenshot of myxaicoin.pages.dev
myxaicoin.pages.dev
Screenshot of othersko.guru
othersko.guru
13 VTActiveAngel Drainer
Screenshot of othersko.guru
othersko.guru
Screenshot of pepeheimer-claim.com
pepeheimer-claim.com
13 VTActiveSolana Drainer1inch
Screenshot of pepeheimer-claim.com
pepeheimer-claim.com
Screenshot of purchase2-blockdags-networks.pages.dev
purchase2-blockdags-networks.pages.dev
13 VTUnknownacross
Screenshot of purchase2-blockdags-networks.pages.dev
purchase2-blockdags-networks.pages.dev
Screenshot of thecrito.guru
thecrito.guru
13 VTActiveAngel Drainer
Screenshot of thecrito.guru
thecrito.guru
Screenshot of unisara.guru
unisara.guru
13 VTActiveAngel Drainer
Screenshot of unisara.guru
unisara.guru
Screenshot of wallstreetpepe-online-d3n.pages.dev
wallstreetpepe-online-d3n.pages.dev
13 VTActive
Screenshot of wallstreetpepe-online-d3n.pages.dev
wallstreetpepe-online-d3n.pages.dev
app-snortertoken.pages.dev
12 VTUnknownOKX
Screenshot of best-wallettoken.com
best-wallettoken.com
12 VTUnknownWallet Connect Abuseacross
Screenshot of best-wallettoken.com
best-wallettoken.com
Screenshot of blazpay.co
blazpay.co
12 VTActiveAngel Draineracross
Screenshot of blazpay.co
blazpay.co
Screenshot of claim-pepenode.io
claim-pepenode.io
12 VTUnknownMetaMask
Screenshot of claim-pepenode.io
claim-pepenode.io
Screenshot of conilst.co
conilst.co
12 VTActiveacross
Screenshot of conilst.co
conilst.co
labtoken.live
12 VTActiveOKX
Screenshot of litltlepepe.com
litltlepepe.com
12 VTActiveAngel Drainergenericcrypto
Screenshot of litltlepepe.com
litltlepepe.com
Screenshot of myxaiconnects.net
myxaiconnects.net
12 VTUnknownBinance
Screenshot of myxaiconnects.net
myxaiconnects.net
Screenshot of octra.run
octra.run
12 VTUnknownAngel Drainerdiscord
Screenshot of octra.run
octra.run
Screenshot of pump-presale.org
pump-presale.org
12 VTActive
Screenshot of pump-presale.org
pump-presale.org
Screenshot of qaddun.com
qaddun.com
12 VTActivebinance
Screenshot of qaddun.com
qaddun.com
Screenshot of ruviai.net
ruviai.net
12 VTUnknown
Screenshot of ruviai.net
ruviai.net
Screenshot of spx98k.com
spx98k.com
12 VTActive
Screenshot of spx98k.com
spx98k.com
Screenshot of timwarrencoin.io
timwarrencoin.io
12 VTActiveAngel Drainer
Screenshot of timwarrencoin.io
timwarrencoin.io
Screenshot of unilabs.finance
unilabs.finance
12 VTActiveacross
Screenshot of unilabs.finance
unilabs.finance
Screenshot of bullzila.com
bullzila.com
11 VTActiveAngel Drainergenericcrypto
Screenshot of bullzila.com
bullzila.com
Screenshot of cryptoallstars-reward.web.app
cryptoallstars-reward.web.app
11 VTUnknownacross
Screenshot of cryptoallstars-reward.web.app
cryptoallstars-reward.web.app
Screenshot of grok54h-cointelegraph.com
grok54h-cointelegraph.com
11 VTUnknown
Screenshot of grok54h-cointelegraph.com
grok54h-cointelegraph.com
Screenshot of one.link
one.link
11 VTActiveApple
Screenshot of one.link
one.link
Screenshot of pepeto-claiming.io
pepeto-claiming.io
11 VTUnknown
Screenshot of pepeto-claiming.io
pepeto-claiming.io
Screenshot of portalbridge.app
portalbridge.app
11 VTActiveAngel Drainer
Screenshot of portalbridge.app
portalbridge.app
Screenshot of resolvetics.web.app
resolvetics.web.app
11 VTActiveacross
Screenshot of resolvetics.web.app
resolvetics.web.app
Screenshot of rnbw-coiniist.co
rnbw-coiniist.co
11 VTUnknownacross
Screenshot of rnbw-coiniist.co
rnbw-coiniist.co
Screenshot of alphapepetokenpresale.online
alphapepetokenpresale.online
10 VTUnknown
Screenshot of alphapepetokenpresale.online
alphapepetokenpresale.online
Screenshot of claim.snortertokn.live
claim.snortertokn.live
10 VTActive
Screenshot of claim.snortertokn.live
claim.snortertokn.live
Screenshot of dashboard-bestwallet.firebaseapp.com
dashboard-bestwallet.firebaseapp.com
10 VTActiveWallet Connect Abuseacross
Screenshot of dashboard-bestwallet.firebaseapp.com
dashboard-bestwallet.firebaseapp.com
Screenshot of gro39k.org
gro39k.org
10 VTActiveEthereum
Screenshot of gro39k.org
gro39k.org
Screenshot of grok25h.com
grok25h.com
10 VTActiveEthereum
Screenshot of grok25h.com
grok25h.com
Screenshot of grok35k-fxempire.com
grok35k-fxempire.com
10 VTActiveacross
Screenshot of grok35k-fxempire.com
grok35k-fxempire.com
Screenshot of neexoraa.com
neexoraa.com
10 VTActiveApple
Screenshot of neexoraa.com
neexoraa.com
Screenshot of nx0b6we.pages.dev
nx0b6we.pages.dev
10 VTActiveGoogle
Screenshot of nx0b6we.pages.dev
nx0b6we.pages.dev
Screenshot of reward-snortertoken.com
reward-snortertoken.com
10 VTUnknownWallet Connect Abusedextools
Screenshot of reward-snortertoken.com
reward-snortertoken.com
Screenshot of sale-maxidoge.com
sale-maxidoge.com
10 VTUnknowndiscord
Screenshot of sale-maxidoge.com
sale-maxidoge.com
Screenshot of basetoken.sale
basetoken.sale
9 VTActivebase
Screenshot of basetoken.sale
basetoken.sale
Screenshot of bitcoinhyper.us
bitcoinhyper.us
9 VTActiveAngel Drainermetamask
Screenshot of bitcoinhyper.us
bitcoinhyper.us
Screenshot of inqubetai-node.pages.dev
inqubetai-node.pages.dev
9 VTActiveGoogle
Screenshot of inqubetai-node.pages.dev
inqubetai-node.pages.dev
Screenshot of litlelpepe.com
litlelpepe.com
9 VTActiveAngel Drainerethereum
Screenshot of litlelpepe.com
litlelpepe.com
Screenshot of pepeascensionclaim.pages.dev
pepeascensionclaim.pages.dev
9 VTUnknown
Screenshot of pepeascensionclaim.pages.dev
pepeascensionclaim.pages.dev
Screenshot of qubeticsverification.web.app
qubeticsverification.web.app
9 VTActiveacross
Screenshot of qubeticsverification.web.app
qubeticsverification.web.app
Screenshot of xaifusion.com
xaifusion.com
9 VTUnknown
Screenshot of xaifusion.com
xaifusion.com
grok73k-cointelegraph.com
8 VTUnknown
Screenshot of magacoin.info
magacoin.info
8 VTActiveAngel Drainer
Screenshot of magacoin.info
magacoin.info
Screenshot of rainbows.run
rainbows.run
8 VTActiveAngel Draineracross
Screenshot of rainbows.run
rainbows.run
Screenshot of spx15k.com
spx15k.com
8 VTActive
Screenshot of spx15k.com
spx15k.com
Screenshot of tapzi-io.xyz
tapzi-io.xyz
8 VTUnknownAngel Draineracross
Screenshot of tapzi-io.xyz
tapzi-io.xyz
Screenshot of www-grok-allocation.xyz
www-grok-allocation.xyz
8 VTUnknownAngel Drainercoinbase
Screenshot of www-grok-allocation.xyz
www-grok-allocation.xyz
Screenshot of www.bestwalletsclaim.live
www.bestwalletsclaim.live
8 VTUnknownacross
Screenshot of www.bestwalletsclaim.live
www.bestwalletsclaim.live
Screenshot of blockdagpresalenetwork.online
blockdagpresalenetwork.online
7 VTActiveAngel DrainerBlockDAG
Screenshot of blockdagpresalenetwork.online
blockdagpresalenetwork.online
Screenshot of btchyperapp.pages.dev
btchyperapp.pages.dev
7 VTActiveMetaMask
Screenshot of btchyperapp.pages.dev
btchyperapp.pages.dev
elon-dzr.pages.dev
7 VTUnknowngenericcrypto
Screenshot of grok35k.net
grok35k.net
7 VTActiveEthereum
Screenshot of grok35k.net
grok35k.net
Screenshot of grok49k.com
grok49k.com
7 VTActiveEthereum
Screenshot of grok49k.com
grok49k.com
Screenshot of harambeaiclaim.web.app
harambeaiclaim.web.app
7 VTUnknownWallet Connect Abusegenericcrypto
Screenshot of harambeaiclaim.web.app
harambeaiclaim.web.app
Screenshot of ionichain.com
ionichain.com
7 VTUnknownAngel Draineraave
Screenshot of ionichain.com
ionichain.com
Screenshot of spx21k.com
spx21k.com
7 VTUnknown
Screenshot of spx21k.com
spx21k.com
Screenshot of bdagnetwork.info
bdagnetwork.info
6 VTUnknowngenericcrypto
Screenshot of bdagnetwork.info
bdagnetwork.info
1 2 3 Next » Page 1 of 3

Threat Response Pipeline

How every domain in this hub is verified and how confirmed threats are neutralized. Full pipeline visualization →

Threat Intelligence Checks— every domain is scanned & cross-checked against:
urlscan.ioScreenshot · DOM · HTTPVirusTotal90+ AV enginesGoogle Safe BrowsingTransparency ReportCloudflare RadarDNS · certs · categoriesAlienVault OTXThreat-intel pulsesWayback MachineHistorical evidenceabuse.ch ThreatFoxIOC correlationcrt.shCertificate TransparencyDNS Security FiltersQuad9 · AdGuard · CleanBrowsingWeb-CheckFull surface scan
Global Vendor Sync— confirmed detections are pushed to 29 partners:
GoogleSafe BrowsingGoogleWeb Risk APIMicrosoftSmartScreenVirusTotalDetection feedCloudflareRadar / 1.1.1.1YandexSafe BrowsingURLScan.ioPublic scanESETWebGuardBitdefenderThreat exchangeNortonSafe WebSymantecSiteReviewAviraCloud detectionAvast / AVGWeb ShieldKasperskyOpenTIPDr.WebOnline scannerNetcraftTakedown APIPhishTankVerified voteAPWG eCXBulk feedPhishStatsOpen feedPhish.ReportHosting abuseSpamhausDBL feedPolySwarmMarketplaceCheckPhishBolster scanQutteraMalware scanURLquerySandboxCriminal IPAsset intelCRDFThreat CenterScamadviserTrust scoreMyWOTWeb of Trust