# presale-satoshidexai.pages.dev — SUSPICIOUS

> presale-satoshidexai.pages.dev is a crypto scam luring users with fake presale offers. It's flagged on 2 blocklists and resolves to 188.114.96.3.

## Summary
PhishDestroy identifies presale-satoshidexai.pages.dev as an active crypto scam domain posing as a legitimate presale platform for a purported exchange. The site employs social engineering tactics—specifically, a fake token presale—to trick users into connecting cryptocurrency wallets or transferring funds to attacker-controlled addresses. This domain was flagged by multiple security vendors including ScamSniffer and Enkrypt, and is currently under active investigation due to consistent reports of fraudulent activity targeting cryptocurrency enthusiasts.  

Technical analysis reveals several red flags: the domain resolves to IP address 188.114.96.3 and is hosted on Cloudflare’s infrastructure via pages.dev. Despite utilizing a TLS certificate issued by Google Trust Services—often leveraged to appear legitimate—it has already been blocked by two major security platforms and currently shows zero detections on VirusTotal out of 95 scanners. This suggests either a very new campaign or evasive techniques designed to bypass initial detection layers. The use of Cloudflare Pages, a legitimate service, highlights a growing trend among threat actors to abuse reputable hosting platforms to host malicious content while maintaining operational stealth.  

Users who have visited presale-satoshidexai.pages.dev or interacted with its content are strongly advised to immediately revoke any wallet connections made through the site, transfer remaining funds to a secure wallet, and monitor for unauthorized transactions. If cryptocurrency was sent, report the incident to local authorities and file a complaint with relevant cybercrime units. Enable multi-factor authentication on all financial accounts and consider using hardware wallets for enhanced protection. Always verify presale platforms through official websites and community channels before engaging.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["ScamSniffer", "Enkrypt"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/b2f5293d-b86f-4743-9764-7a2ce6ebf097
- PhishDestroy: https://phishdestroy.io/domain/presale-satoshidexai.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/presale-satoshidexai.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/presale-satoshidexai.pages.dev/
Last updated: 2026-03-28