presale[.]shadenetwork[.]live

The domain presale.shadenetwork.live is currently classified as a high‑risk generic phishing site. It was registered on March 5, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 172.67.180.17, which belongs to the Cloudflare network (AS13335) located in the United States. The domain is actively serving content, as indicated by an HTTP 200 response, and its DNS configuration points to Cloudflare’s authoritative nameservers maya.ns.cloudflare.com and amos.ns.cloudflare.com. The SSL certificate in use is issued by Let’s Encrypt (identifier E7), providing valid TLS encryption for the site.

Visible content on the site includes the page title "Shade Network — The Private Execution Layer" and the presence of front‑end frameworks such as Bootstrap, along with Cloudflare Browser Insights and HTTP/3 support. VirusTotal analysis shows that 2 out of 95 security vendors have flagged the domain, and it appears on a single external blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. The domain is also listed as blocked by the PhishDestroy service, confirming that at least one anti‑phishing organization has taken mitigation action.

Defenders should prioritize blocking presale.shadenetwork.live at network perimeters and updating any URL filtering or DNS sinkhole policies to include the domain and its associated IP address. Continuous monitoring of Cloudflare‑hosted infrastructure for similar patterns is advised, as the use of shared services can obscure underlying threat actors. Given the high risk rating and active status, rapid remediation and user awareness campaigns targeting potential credential‑stealing attempts are recommended to reduce exposure.