perenapresale[.]xyz

Analysis of perenapresale.xyz shows an active infrastructure supporting a crypto‑related brand‑impersonation campaign. The site returns HTTP 200 and hosts a TLS certificate issued by Let’s Encrypt (R12). DNS resolution points to 45.12.2.67, an address registered to AS6698 Virtual Systems LLC in Ukraine and hosted on a Plesk server behind Nginx with Tailwind CSS front‑end assets. Both authoritative nameservers (ns1.perenapresale.xyz, ns2.perenapresale.xyz) resolve to the same IP, and an MX record (mail.perenapresale.xyz) is configured, indicating potential email usage. The domain was created on 3 Nov 2025 through Ultahost, Inc., and has a Gridinsoft trust score of 0 / 100. VirusTotal reports five detections out of ninety‑five scanners, and the domain appears on a single external blocklist. The page title “Perena (PERENA) Token Presale | Programmable Stablecoin for DeFi” and the identified “Token Presale” phishing kit align with the declared scam type of a crypto scam that impersonates the BNB Chain brand. The site has already been flagged by PhishDestroy. While the exact page content has not been inspected, the combination of brand‑impersonation language, low trust score, and multiple security detections suggests a high‑risk operation. Defenders should add perenapresale.xyz to URL blocklists, monitor DNS queries for the associated IP and nameservers, and consider sinkholing traffic. Email filters should also block the MX host. Ongoing observation is advised to detect any evolution of the campaign.