presale-cambria[.]live

This domain, presale-cambria.live, is confirmed as a cryptocurrency presale scam designed to deceive investors into transferring funds under false pretenses. Analysis indicates no legitimate association with any known blockchain project or token sale, suggesting the site operated as a fraudulent investment scheme. The domain name mimics a plausible presale campaign, likely targeting users searching for early-stage cryptocurrency opportunities. No specific drainer kit signatures were detected, but the infrastructure aligns with common crypto scam tactics, including the use of Cloudflare for anonymization and Let's Encrypt SSL certificates to appear legitimate. Technical indicators reveal the domain was registered on March 10, 2026, through Global Domain Group LLC, an uncommon date suggesting potential domain spoofing or incorrect WHOIS data. It resolves to IP address 172.67.218.141, a Cloudflare-hosted endpoint, further obscuring its origin. At the time of analysis, 4 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on two security blocklists and is actively blocked by at least two threat intelligence feeds. The page title, reflecting a 522: Connection timed out error, suggests the site was either taken down or abandoned following detection. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains a potential threat vector, as the same actors may repurpose the IP or registrar for future scams. Users who interacted with the site should assume their credentials or wallet addresses were compromised and take immediate action, including revoking token approvals, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.