elon-dzr[.]pages[.]dev

This domain is flagged for hosting a crypto drainer scheme specifically targeting users of a fraudulent $ELON token presale. Analysis indicates the threat type is a wallet-draining phishing kit, designed to trick victims into connecting their cryptocurrency wallets to malicious smart contracts, resulting in unauthorized fund transfers. The infrastructure and tactics align with known token presale scams, where attackers exploit hype around new cryptocurrency projects to siphon assets from unsuspecting participants.

Infrastructure analysis reveals the domain elon-dzr.pages.dev was registered on January 07, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.172. The domain is currently offline but was previously detected by 7 out of 95 security vendors on VirusTotal. It appears on three security blocklists and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by Google Trust Services, a common feature in phishing domains leveraging legitimate certificate authorities to appear credible. The page title, $ELON Presale, directly impersonates a cryptocurrency token, and the domain has been blocked by multiple security platforms, including MetaMask and PhishDestroy, further confirming its malicious intent.

Mitigation against crypto drainer threats requires heightened vigilance during token presales or airdrop events. Users should verify the legitimacy of presale websites by cross-referencing official project channels, such as verified social media accounts or community forums. Wallet security measures, such as using hardware wallets or isolated browser profiles for cryptocurrency transactions, can reduce exposure to malicious smart contracts. Additionally, monitoring wallet activity for unauthorized transactions and revoking suspicious contract approvals via blockchain explorers can limit potential damage. Organizations should update blocklists to include this domain and its associated IP address, while security teams should analyze the phishing kit for indicators of compromise to preemptively detect similar threats.