abstractsale[.]top

Analysis of abstractsale.top, first observed after registration on 2025-10-01, shows a high‑risk brand‑impersonation campaign targeting Binance users. The site presented the page title “Abstract Token Presale | 145,000 ABS per BNB”, a clear indication of a crypto‑related lure. The domain resolves to IP 45.12.2.67, which belongs to AS6698 Virtual Systems LLC and is geolocated in Ukraine. Nameserver configuration includes ns1.abstractsale.top, ns2.abstractsale.top, ns1.juniperbot.top and ns2.juniperbot.top, suggesting the use of custom or compromised name servers. No TLS certificate is deployed, leaving the site reachable only via HTTP.

The registrar listed is NameSilo, LLC. Reputation services rate the domain at the minimum Gridinsoft trust score of 0/100. Google Safe Browsing flags the URL for social engineering, and VirusTotal records 14 of 95 scanned engines labeling the domain as malicious. The domain appears on a single external blocklist, currently blocked by PhishDestroy. The service status is recorded as offline, indicating the site has been taken down or is otherwise inaccessible at the time of reporting. Defenders should update detection rules to flag any DNS resolution to 45.12.2.67 and monitor for the listed nameservers.

Email gateways and web filters should block URLs containing the exact page title string or any reference to “Abstract Token Presale”. Because the domain leverages a brand impersonation of Binance, organizations should reinforce user awareness campaigns about unsolicited token‑sale invitations. Continuous monitoring of the registrar NameSilo for new domains with similar naming patterns is also advised. At present, the primary unknowns are the content of the landing page beyond the title and any additional infrastructure that may have been used for command‑and‑control or data exfiltration. Further sandbox analysis of any retrieved HTML snapshots would be required to confirm payloads or credential‑harvesting mechanisms.