x-presale[.]org

This domain, x-presale.org, is actively flagged as a high-risk cryptocurrency phishing site targeting users through fraudulent token presale offers. Registered on April 17, 2026, via Atak Domain Bilgi Teknolojileri, the domain remains operational as of July 12, 2026, with no indications of takedown or suspension. The page title, 'X Token,' suggests an attempt to impersonate a legitimate cryptocurrency project, likely exploiting the branding of a well-known platform or token to deceive victims into transferring funds or disclosing wallet credentials. Infrastructure analysis reveals the domain resolves to 104.21.20.81 and employs Cloudflare for content delivery and DDoS protection, a common tactic among phishing operators to obscure hosting origins and evade detection. The site uses a Let's Encrypt SSL certificate, which provides basic encryption but does not validate legitimacy. Detection metrics indicate broad consensus across security platforms: the domain appears on five blocklists, is flagged by 13 of 95 security vendors on VirusTotal, and is referenced in 22 threat intelligence pulses on AlienVault OTX. Additional automated trust assessments assign scores of 0/100 and 31/100, reinforcing its classification as malicious. The domain's registration details and hosting patterns align with known phishing campaigns targeting cryptocurrency users. While the exact phishing kit or payload remains unconfirmed, the combination of a recently registered domain, Cloudflare obfuscation, and active blocklist presence strongly suggests ongoing abuse. Defenders should treat this domain as hostile and prioritize blocking at the DNS or network level. Organizations should also monitor for related domains using similar naming conventions or registration patterns, as threat actors frequently rotate infrastructure to sustain operations. No legitimate financial or cryptocurrency service is associated with this domain based on available intelligence.