Search tracked domains and review stored evidence, detections, and the latest observed availability.

196,307
Total Tracked
196,307
VT Detected
88,838
Last Seen Active
98,858
Unavailable at Last Check
0
VT Pending
Fake Token Presale
HIGH THREAT

Understanding and Mitigating Fake Token Presale Threats

PhishDestroy currently associates 237 tracked domain reports with Fake Token Presale. Review stored detections, evidence, and the latest observed availability below.

237
Domains Detected
HIGH
Threat Level

How This Attack Works

Fake Token Presale scams trick victims into believing they are investing in legitimate cryptocurrency projects. Here's how the scam typically unfolds:

STEP 1
Create Fake Websites
Scammers set up realistic-looking websites mimicking legitimate token presale portals.
STEP 2
Promote Presale on Social Media
Using social media and fake endorsements, scammers attract potential investors.
STEP 3
Collect Cryptocurrency
Victims are prompted to send cryptocurrency to a specified address under the guise of buying tokens.
STEP 4
Disappear with Funds
Once funds are collected, scammers shut down the site and disappear, leaving victims without recourse.

Technical Analysis

Fake Token Presale scams often leverage phishing tactics combined with cryptocurrency-specific techniques. Attackers use homograph attacks to create URLs that closely resemble legitimate sites, often registered through top registrars like NICENIC INTERNATIONAL GROUP CO., LIMITED and PDR Ltd. d/b/a PublicDomainRegistry.com. They exploit the decentralized nature of blockchain networks, utilizing smart contracts that mimic legitimate presale contracts but are programmed to divert funds to the attacker’s wallet. The infrastructure often involves cloud-based hosting services to quickly deploy and dismantle sites, minimizing the chance of detection. HTML and JavaScript are commonly used to create dynamic, convincing interfaces that reassure potential victims of the site’s legitimacy. Additionally, attackers might deploy SEO techniques to improve the visibility of their fraudulent sites in search engine results, further increasing their reach.

Real Cases

CryptoX Presale Scam (2024)
$2 million stolen
A fake presale for a non-existent token, CryptoX, duped investors into contributing significant sums.
TokenLaunch Fraud (2023)
$1.5 million stolen
Victims were lured into a fake token launch with promises of high returns, only for the site to vanish post-collection.
QuickCoin Deception (2024)
$3 million stolen
Scammers created a sophisticated site mimicking a known exchange, leading to substantial financial losses.

How to Detect

Check for slight misspellings in domain names.
Look for inconsistent branding or layout compared to legitimate sites.
Be wary of unsolicited investment opportunities via social media.
Verify presale details on official project channels.
Beware of high-pressure tactics urging immediate investment.

How to Protect Yourself

1 Always verify URLs before entering personal information.
2 Use browser extensions to detect phishing attempts.
3 Consult official project websites or channels for presale information.
4 Enable two-factor authentication on cryptocurrency exchanges.
5 Report suspicious sites to authorities and platforms like PhishDestroy.

Frequently Asked Questions

What is Fake Token Presale?
Fake Token Presale is a scam where attackers create fraudulent cryptocurrency presale websites to deceive investors into sending funds for non-existent tokens.
How much money has been stolen through Fake Token Presale?
Millions have been lost to Fake Token Presale scams, with documented cases like CryptoX and QuickCoin resulting in over $6 million in damages.
How do I protect myself from Fake Token Presale?
Verify presale details on official channels, scrutinize website URLs for discrepancies, and use security tools to detect phishing attempts.
What should I do if I'm a victim of Fake Token Presale?
Report the scam to law enforcement, notify your cryptocurrency exchange, and share information with platforms like PhishDestroy to help prevent further incidents.
Data sourced from PhishDestroy threat intelligence database — 237 domains tracked for this threat type
Token Presale — Threat Intelligence Kit High Threat
237
Domains
136
Alive
62
Taken Down
7.1
Avg VT
57.4%
Alive Rate
98.3%
Detected
Since Jul 2025 140 domains with VT ≥ 5
Fake Token Presale 237 domains
Screenshot of bitcoinhyperresolves.netlify.app
bitcoinhyperresolves.netlify.app
6 VTActiveMetaMask
Screenshot of bitcoinhyperresolves.netlify.app
bitcoinhyperresolves.netlify.app
Screenshot of gro11k.com
gro11k.com
6 VTUnknownethereum
Screenshot of gro11k.com
gro11k.com
Screenshot of gro25b-fxempire.com
gro25b-fxempire.com
6 VTActiveacross
Screenshot of gro25b-fxempire.com
gro25b-fxempire.com
Screenshot of gro39k-cointelegraph.com
gro39k-cointelegraph.com
6 VTActive
Screenshot of gro39k-cointelegraph.com
gro39k-cointelegraph.com
Screenshot of gro47k.net
gro47k.net
6 VTUnknownEthereum
Screenshot of gro47k.net
gro47k.net
Screenshot of gro47k.org
gro47k.org
6 VTUnknownEthereum
Screenshot of gro47k.org
gro47k.org
Screenshot of gro75k.com
gro75k.com
6 VTActive
Screenshot of gro75k.com
gro75k.com
Screenshot of gro75k.info
gro75k.info
6 VTActiveEthereum
Screenshot of gro75k.info
gro75k.info
Screenshot of gro75k.org
gro75k.org
6 VTActiveEthereum
Screenshot of gro75k.org
gro75k.org
Screenshot of gro87x.com
gro87x.com
6 VTUnknownEthereum
Screenshot of gro87x.com
gro87x.com
Screenshot of gro88k.com
gro88k.com
6 VTUnknownEthereum
Screenshot of gro88k.com
gro88k.com
Screenshot of gro88k.net
gro88k.net
6 VTUnknownEthereum
Screenshot of gro88k.net
gro88k.net
Screenshot of grok35k.com
grok35k.com
6 VTActiveEthereum
Screenshot of grok35k.com
grok35k.com
Screenshot of grokr-allocations.xyz
grokr-allocations.xyz
6 VTActivecoinbase
Screenshot of grokr-allocations.xyz
grokr-allocations.xyz
Screenshot of liquidchain.info
liquidchain.info
6 VTUnknownAngel Draineracross
Screenshot of liquidchain.info
liquidchain.info
Screenshot of lttllepepe.com
lttllepepe.com
6 VTActiveAngel Drainerethereum
Screenshot of lttllepepe.com
lttllepepe.com
Screenshot of polymarketallocation.net
polymarketallocation.net
6 VTUnknownacross
Screenshot of polymarketallocation.net
polymarketallocation.net
Screenshot of spx21k-fxempire.com
spx21k-fxempire.com
6 VTUnknown
Screenshot of spx21k-fxempire.com
spx21k-fxempire.com
Screenshot of xai19p.com
xai19p.com
6 VTUnknownEthereum
Screenshot of xai19p.com
xai19p.com
Screenshot of apemars-claim-presale-launch-oees33-aert0ds.pages.dev
apemars-claim-presale-launch-oees33-aert0ds.pages.dev
5 VTActive
Screenshot of apemars-claim-presale-launch-oees33-aert0ds.pages.dev
apemars-claim-presale-launch-oees33-aert0ds.pages.dev
Screenshot of bl0ckdag.network
bl0ckdag.network
5 VTActivegenericcrypto
Screenshot of bl0ckdag.network
bl0ckdag.network
Screenshot of blockdagnetwork.web.app
blockdagnetwork.web.app
5 VTActiveacross
Screenshot of blockdagnetwork.web.app
blockdagnetwork.web.app
Screenshot of collectfoundation.com
collectfoundation.com
5 VTActiveAngel Drainer
Screenshot of collectfoundation.com
collectfoundation.com
Screenshot of cysicpresale.xyz
cysicpresale.xyz
5 VTActiveacross
Screenshot of cysicpresale.xyz
cysicpresale.xyz
Screenshot of gr0k2025.net
gr0k2025.net
5 VTUnknown
Screenshot of gr0k2025.net
gr0k2025.net
Screenshot of gro25b-cointelegraph.com
gro25b-cointelegraph.com
5 VTUnknownacross
Screenshot of gro25b-cointelegraph.com
gro25b-cointelegraph.com
Screenshot of gro25b.com
gro25b.com
5 VTUnknownEthereum
Screenshot of gro25b.com
gro25b.com
Screenshot of gro25b.org
gro25b.org
5 VTUnknownEthereum
Screenshot of gro25b.org
gro25b.org
Screenshot of gro75k-cointelegraph.com
gro75k-cointelegraph.com
5 VTActive
Screenshot of gro75k-cointelegraph.com
gro75k-cointelegraph.com
Screenshot of gro75k.net
gro75k.net
5 VTActiveEthereum
Screenshot of gro75k.net
gro75k.net
Screenshot of grok49k-fxempire.com
grok49k-fxempire.com
5 VTActive
Screenshot of grok49k-fxempire.com
grok49k-fxempire.com
Screenshot of grok49k.net
grok49k.net
5 VTActiveEthereum
Screenshot of grok49k.net
grok49k.net
Screenshot of littelpepe.com
littelpepe.com
5 VTActiveAngel Drainerethereum
Screenshot of littelpepe.com
littelpepe.com
Screenshot of llttlepepe.com
llttlepepe.com
5 VTActiveAngel Drainergenericcrypto
Screenshot of llttlepepe.com
llttlepepe.com
Screenshot of lttlepepe.com
lttlepepe.com
5 VTActiveAngel Drainerethereum
Screenshot of lttlepepe.com
lttlepepe.com
Screenshot of meteoracheck.live
meteoracheck.live
5 VTActiveSolana Drainercurve
Screenshot of meteoracheck.live
meteoracheck.live
Screenshot of monoprotocol.live
monoprotocol.live
5 VTUnknownAngel Draineracross
Screenshot of monoprotocol.live
monoprotocol.live
Screenshot of opz-io.xyz
opz-io.xyz
5 VTUnknownAngel Draineracross
Screenshot of opz-io.xyz
opz-io.xyz
Screenshot of spx99x.org
spx99x.org
5 VTActive
Screenshot of spx99x.org
spx99x.org
Screenshot of thetokencentral.com
thetokencentral.com
5 VTActive
Screenshot of thetokencentral.com
thetokencentral.com
auction-zkp.app
4 VTActive
Screenshot of bitcoins-hyper.pages.dev
bitcoins-hyper.pages.dev
4 VTActiveEthereum
Screenshot of bitcoins-hyper.pages.dev
bitcoins-hyper.pages.dev
Screenshot of bl0ckdaq.network
bl0ckdaq.network
4 VTUnknownacross
Screenshot of bl0ckdaq.network
bl0ckdaq.network
Screenshot of block-dagnet.live
block-dagnet.live
4 VTActiveacross
Screenshot of block-dagnet.live
block-dagnet.live
Screenshot of blockdag-network-en.web.app
blockdag-network-en.web.app
4 VTActiveWallet Connect Abuseacross
Screenshot of blockdag-network-en.web.app
blockdag-network-en.web.app
Screenshot of deepsnitch.net
deepsnitch.net
4 VTActiveAngel Drainerbase
Screenshot of deepsnitch.net
deepsnitch.net
Screenshot of gro25b.net
gro25b.net
4 VTUnknownEthereum
Screenshot of gro25b.net
gro25b.net
Screenshot of grok35k-cointelegraph.com
grok35k-cointelegraph.com
4 VTUnknownacross
Screenshot of grok35k-cointelegraph.com
grok35k-cointelegraph.com
Screenshot of helioschain.net
helioschain.net
4 VTUnknownAngel Drainer
Screenshot of helioschain.net
helioschain.net
Screenshot of ionixblockchain.com
ionixblockchain.com
4 VTUnknownBlockchain.com
Screenshot of ionixblockchain.com
ionixblockchain.com
Screenshot of ionixchain.co
ionixchain.co
4 VTActiveAngel Draineraave
Screenshot of ionixchain.co
ionixchain.co
Screenshot of nexchain.exchange
nexchain.exchange
4 VTActiveAngel Draineracross
Screenshot of nexchain.exchange
nexchain.exchange
Screenshot of peperider.com
peperider.com
4 VTActiveWallet Connect Abuseethereum
Screenshot of peperider.com
peperider.com
Screenshot of perenapresale.xyz
perenapresale.xyz
4 VTActivebnb chain
Screenshot of perenapresale.xyz
perenapresale.xyz
Screenshot of ruviai.info
ruviai.info
4 VTActiveAngel Drainerethereum
Screenshot of ruviai.info
ruviai.info
Screenshot of spx99x.net
spx99x.net
4 VTActive
Screenshot of spx99x.net
spx99x.net
Screenshot of xaidov-fxempire.com
xaidov-fxempire.com
4 VTUnknown
Screenshot of xaidov-fxempire.com
xaidov-fxempire.com
Screenshot of xaifox-fxempire.com
xaifox-fxempire.com
4 VTUnknown
Screenshot of xaifox-fxempire.com
xaifox-fxempire.com
Screenshot of aaasz.pages.dev
aaasz.pages.dev
3 VTActive
Screenshot of aaasz.pages.dev
aaasz.pages.dev
Screenshot of bestwallet.top
bestwallet.top
3 VTUnknownAngel Drainer
Screenshot of bestwallet.top
bestwallet.top
Screenshot of bestwallettoken.com
bestwallettoken.com
3 VTActiveWallet Connect Abuseacross
Screenshot of bestwallettoken.com
bestwallettoken.com
Screenshot of bitcoinhyper.de
bitcoinhyper.de
3 VTActiveAngel DrainerMetaMask
Screenshot of bitcoinhyper.de
bitcoinhyper.de
Screenshot of bitcoinhyper.pages.dev
bitcoinhyper.pages.dev
3 VTUnknownBitcoin
Screenshot of bitcoinhyper.pages.dev
bitcoinhyper.pages.dev
Screenshot of bitcoinhyperpresale.com
bitcoinhyperpresale.com
3 VTActiveWallet Connect AbuseEthereum
Screenshot of bitcoinhyperpresale.com
bitcoinhyperpresale.com
Screenshot of bitcoinpepe-live.web.app
bitcoinpepe-live.web.app
3 VTUnknownWallet Connect Abuseblast
Screenshot of bitcoinpepe-live.web.app
bitcoinpepe-live.web.app
Screenshot of bitcoinshyper.live
bitcoinshyper.live
3 VTActiveethereum
Screenshot of bitcoinshyper.live
bitcoinshyper.live
Screenshot of blastuptoken.github.io
blastuptoken.github.io
3 VTActiveBlast
Screenshot of blastuptoken.github.io
blastuptoken.github.io
Screenshot of blockdag-server.web.app
blockdag-server.web.app
3 VTUnknownBlockDAG
Screenshot of blockdag-server.web.app
blockdag-server.web.app
Screenshot of claimsflockerz.pages.dev
claimsflockerz.pages.dev
3 VTActive
Screenshot of claimsflockerz.pages.dev
claimsflockerz.pages.dev
Screenshot of deepsnitch.io
deepsnitch.io
3 VTActiveAngel Drainerbase
Screenshot of deepsnitch.io
deepsnitch.io
Screenshot of dogshltmeme.xyz
dogshltmeme.xyz
3 VTUnknownAngel Drainergenericcrypto
Screenshot of dogshltmeme.xyz
dogshltmeme.xyz
Screenshot of flockerz-dh1.pages.dev
flockerz-dh1.pages.dev
3 VTActive
Screenshot of flockerz-dh1.pages.dev
flockerz-dh1.pages.dev
gro87x.org
3 VTUnknownEthereum
hotdeal.com
3 VTActiveAngel Drainer
Screenshot of ionixchain.org
ionixchain.org
3 VTActiveAngel Draineraave
Screenshot of ionixchain.org
ionixchain.org
Screenshot of kadven.io
kadven.io
3 VTUnknownbinance
Screenshot of kadven.io
kadven.io
nlp1rbp.pages.dev
3 VTActive
Screenshot of pepeheimer-claimlive.pages.dev
pepeheimer-claimlive.pages.dev
3 VTActive
Screenshot of pepeheimer-claimlive.pages.dev
pepeheimer-claimlive.pages.dev
Screenshot of pepeoftherings.io
pepeoftherings.io
3 VTActiveWallet Connect Abuseacross
Screenshot of pepeoftherings.io
pepeoftherings.io
Screenshot of pexebel.com
pexebel.com
3 VTActiveWallet Connect Abuseacross
Screenshot of pexebel.com
pexebel.com
Screenshot of pexebel.us
pexebel.us
3 VTActiveAngel Draineracross
Screenshot of pexebel.us
pexebel.us
Screenshot of rainbows.bet
rainbows.bet
3 VTActiveAngel Draineracross
Screenshot of rainbows.bet
rainbows.bet
Screenshot of rnbw.rainsbow.xyz
rnbw.rainsbow.xyz
3 VTUnknownAngel Draineracross
Screenshot of rnbw.rainsbow.xyz
rnbw.rainsbow.xyz
Screenshot of seismicpresale.xyz
seismicpresale.xyz
3 VTUnknownbnb chain
Screenshot of seismicpresale.xyz
seismicpresale.xyz
Screenshot of silverbullsfx.com
silverbullsfx.com
3 VTActiveacross
Screenshot of silverbullsfx.com
silverbullsfx.com
Screenshot of snorterstoken.live
snorterstoken.live
3 VTActiveAngel Drainerdextools
Screenshot of snorterstoken.live
snorterstoken.live
Screenshot of solaxy-sol.pages.dev
solaxy-sol.pages.dev
3 VTActive
Screenshot of solaxy-sol.pages.dev
solaxy-sol.pages.dev
Screenshot of spx10k-cointelegraph.com
spx10k-cointelegraph.com
3 VTUnknownceler
Screenshot of spx10k-cointelegraph.com
spx10k-cointelegraph.com
spx10k-cryptoslate.com
3 VTUnknownacross
Screenshot of spx15k-cryptoslate.com
spx15k-cryptoslate.com
3 VTUnknownacross
Screenshot of spx15k-cryptoslate.com
spx15k-cryptoslate.com
Screenshot of spx15k-fxempire.com
spx15k-fxempire.com
3 VTUnknownMicrosoft
Screenshot of spx15k-fxempire.com
spx15k-fxempire.com
Screenshot of spx98k.org
spx98k.org
3 VTActive
Screenshot of spx98k.org
spx98k.org
Screenshot of subbdtoken.wiki
subbdtoken.wiki
3 VTActiveAngel Drainergenericcrypto
Screenshot of subbdtoken.wiki
subbdtoken.wiki
Screenshot of syneris.tech
syneris.tech
3 VTActive
Screenshot of syneris.tech
syneris.tech
Screenshot of uniontoken.sale
uniontoken.sale
3 VTActiveacross
Screenshot of uniontoken.sale
uniontoken.sale
Screenshot of www.spydoge.com
www.spydoge.com
3 VTActiveWallet Connect AbuseBinance
Screenshot of www.spydoge.com
www.spydoge.com
Screenshot of xainog-fxempire.com
xainog-fxempire.com
3 VTUnknown
Screenshot of xainog-fxempire.com
xainog-fxempire.com
zcfo2r2.pages.dev
3 VTActiveBinance
Screenshot of 5th-scape-token.pages.dev
5th-scape-token.pages.dev
2 VTActiveOKX
Screenshot of 5th-scape-token.pages.dev
5th-scape-token.pages.dev
Screenshot of bestwalletone.com
bestwalletone.com
2 VTActiveAngel Draineracross
Screenshot of bestwalletone.com
bestwalletone.com
« Prev 1 2 3 Next » Page 2 of 3

Threat Response Pipeline

How every domain in this hub is verified and how confirmed threats are neutralized. Full pipeline visualization →

Threat Intelligence Checks— every domain is scanned & cross-checked against:
urlscan.ioScreenshot · DOM · HTTPVirusTotal90+ AV enginesGoogle Safe BrowsingTransparency ReportCloudflare RadarDNS · certs · categoriesAlienVault OTXThreat-intel pulsesWayback MachineHistorical evidenceabuse.ch ThreatFoxIOC correlationcrt.shCertificate TransparencyDNS Security FiltersQuad9 · AdGuard · CleanBrowsingWeb-CheckFull surface scan
Global Vendor Sync— confirmed detections are pushed to 29 partners:
GoogleSafe BrowsingGoogleWeb Risk APIMicrosoftSmartScreenVirusTotalDetection feedCloudflareRadar / 1.1.1.1YandexSafe BrowsingURLScan.ioPublic scanESETWebGuardBitdefenderThreat exchangeNortonSafe WebSymantecSiteReviewAviraCloud detectionAvast / AVGWeb ShieldKasperskyOpenTIPDr.WebOnline scannerNetcraftTakedown APIPhishTankVerified voteAPWG eCXBulk feedPhishStatsOpen feedPhish.ReportHosting abuseSpamhausDBL feedPolySwarmMarketplaceCheckPhishBolster scanQutteraMalware scanURLquerySandboxCriminal IPAsset intelCRDFThreat CenterScamadviserTrust scoreMyWOTWeb of Trust