presale[.]pages[.]dev

PhishDestroy identifies presale.pages.dev as an active crypto drainer phishing domain. The domain is currently under investigation but remains unflagged by security vendors, posing an immediate risk to cryptocurrency users. This threat involves malicious websites designed to drain funds from connected wallets by tricking users into approving malicious transactions or revealing private keys. The domain leverages Google Trust Services SSL certificates to appear legitimate, a common tactic among cybercriminals to bypass browser warnings. The domain resolves to IP 172.66.47.201, which is registered through Cloudflare, Inc., a legitimate hosting provider often abused by threat actors for anonymity. VirusTotal currently shows 1/95 detections, indicating no proactive blocking by antivirus or security vendors as of this report. The use of Google Trust Services SSL certificates further complicates detection, as these certificates are widely trusted by browsers. The domain's Pages.dev subdomain suggests it may be part of a larger campaign targeting users through deceptive presale offers, a common lure in crypto drainer schemes. Mitigation for this crypto drainer threat involves immediate avoidance of the domain and any associated links. Users should never connect cryptocurrency wallets or enter private keys or seed phrases on untrusted websites. Verify the legitimacy of presale offers through official channels, such as the project's verified website or social media accounts. If accidental interaction occurs, users should revoke any wallet connections immediately and transfer funds to a secure wallet. Additionally, report the domain to security vendors and block it at the network level to prevent further victimization.