zcfo2r2[.]pages[.]dev

This domain is flagged as a high-risk crypto drainer impersonating Binance to facilitate fraudulent presale token offerings. The infrastructure is designed to deceive users into connecting wallets, enabling unauthorized transaction signing and subsequent asset theft. The page title, 币安人生 | Presale, directly references Binance (币安) and a presale event, a common tactic to exploit investor interest in early-stage token sales. Analysis indicates the domain was registered on April 04, 2026, through Cloudflare, Inc., and remains active. It resolves to the IP address 172.66.44.57, hosted by Cloudflare in Canada. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. Security vendors on VirusTotal detect the domain at a rate of 4/95, while it appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The combination of brand impersonation, presale-themed lures, and wallet-draining functionality elevates the risk profile significantly. Users encountering this domain should immediately disconnect any connected wallets and revoke permissions via blockchain explorers or wallet management tools. No transactions should be authorized on the site, as interaction may result in irreversible asset loss. Verification of presale legitimacy should be conducted exclusively through official Binance channels, and users are advised to monitor wallet activity for unauthorized transactions. Given the domain's active status and blocklist presence, it is recommended to treat all interactions with this infrastructure as malicious.