rectifyall-presale[.]pages[.]dev

The domain rectifyall-presale.pages.dev has been identified as a crypto drainer phishing site, specifically designed to compromise Ethereum Virtual Machine (EVM) wallets through fraudulent transaction prompts. Analysis indicates this is not a generic phishing attempt but a targeted attack against cryptocurrency users, leveraging social engineering to trick victims into authorizing malicious smart contracts. The site is currently offline, though prior activity suggests it may have been operational during a limited window to evade detection. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. The domain was created on April 18, 2026, an anomalous future date that may indicate falsified registration data or an attempt to obscure its true origins. Security vendors on VirusTotal flagged the domain, with 15 out of 95 engines detecting malicious activity. The site appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as high-risk. Google Safe Browsing has explicitly flagged the domain for social engineering tactics. The current status of rectifyall-presale.pages.dev is offline, though domains of this nature frequently reappear under altered names or infrastructure. Users who interacted with the site should immediately revoke any smart contract approvals granted during the suspected exposure period. Wallet providers and security teams are advised to monitor for similar domains leveraging Cloudflare Pages infrastructure, particularly those with future-dated registrations or low trust scores. Proactive measures include blocking the IP 188.114.96.3 at the network level and adding the domain to internal threat intelligence feeds. Cryptocurrency users should verify all transaction requests through official wallet interfaces and avoid interacting with unsolicited prompts, even if they appear to originate from trusted sources.