demo-presale-c24[.]pages[.]dev

This domain, demo-presale-c24.pages.dev, is currently operating as an active crypto drainer phishing endpoint designed to siphon cryptocurrency assets from unsuspecting users. Analysis of the page title, Demo Presale, combined with infrastructure patterns, indicates this site mimics legitimate token presale events to trick victims into connecting their digital wallets. Once connected, malicious smart contracts execute unauthorized transactions, transferring funds to attacker-controlled addresses without user consent. The threat specifically targets users participating in early-stage crypto offerings, exploiting their anticipation of high returns to bypass security awareness. Technical indicators confirm the domain's malicious infrastructure. The site resolves to IP address 188.114.97.3, hosted under Cloudflare's AS13335, a common obfuscation tactic used to conceal origin servers. Registered through Cloudflare, Inc. on November 23, 2023, the domain remains undetected by most security engines, with a VirusTotal score of 0/95 detections. Despite this low detection rate, the domain appears on one security blocklist, suggesting emerging recognition of its fraudulent nature. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy while failing to mitigate the underlying threat. Users who visited demo-presale-c24.pages.dev and connected a wallet should immediately revoke all active smart contract approvals using a blockchain explorer or dedicated revocation tool. All connected wallets should be treated as compromised, necessitating the transfer of remaining assets to a new, secure wallet. Monitor transaction histories for unauthorized transfers and report the incident to relevant crypto security platforms. Given the domain's active status and low detection rate, heightened vigilance is required for similar presale-themed sites, particularly those hosted on Cloudflare Pages infrastructure.