variationalpresale[.]xyz

The domain variationalpresale.xyz has been identified as a brand impersonation threat specifically targeting MetaMask users. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent token presale and airdrop scheme designed to deceive cryptocurrency holders. The page title, 'Variational (VAR) Token Presale & Airdrop | Zero-Fee Perps Trading,' explicitly mimics legitimate decentralized finance platforms to lure victims. Technical indicators reveal the domain was flagged by 8 of 95 security vendors on VirusTotal, a notably elevated detection rate for a recently registered domain. It was created on November 03, 2025, and registered through Ultahost, Inc. Infrastructure analysis shows the domain resolved to the IP address 45.12.2.67 and was hosted on a server utilizing Plesk, Tailwind CSS, and Nginx technologies. The domain appears on three security blocklists and holds a trust score of 0/100, as assessed by Gridinsoft. The SSL certificate was issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to phishing sites. Additional protections were observed, with the domain blocked by MetaMask, SEAL, and PhishDestroy, indicating widespread recognition of its malicious intent. Given the domain’s current offline status, the immediate threat appears mitigated; however, similar campaigns often resurface under new domains. Users are advised to verify all token presale and airdrop offers through official MetaMask channels or trusted cryptocurrency platforms. Security teams should monitor for domains registered via Ultahost with similar naming patterns or infrastructure, particularly those resolving to the IP range associated with 45.12.2.67. Blocking the IP and domain at the network level is recommended for organizations seeking to prevent potential exposure. End-users should enable browser-based phishing protections and exercise caution when interacting with unsolicited cryptocurrency offers.