bestredeem[.]icu

Analysis of bestredeem.icu indicates a fraudulent domain impersonating Discord to promote a cryptocurrency token presale. The domain, registered on August 18, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP address 216.198.79.65, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The site was taken offline by the time of this assessment, but prior data reveals a page title explicitly referencing a '$BEST Token Presale: Best Crypto Presale & Coin Launch 2025,' aligning with the 'Social Media Phishing' classification provided in threat intelligence. Infrastructure analysis shows the domain holds a Gridinsoft trust score of 0/100 and appears on at least one security blocklist, with PhishDestroy actively blocking it.

Eight of 93 security vendors on VirusTotal flagged the domain as malicious. The SSL certificate is classified as R11, a low-assurance certificate type often associated with short-lived or disposable domains. The combination of a recent registration date, low trust scores, and explicit crypto presale language suggests a high-risk operation targeting users through social engineering, likely leveraging Discord’s brand to lend false credibility. Defenders should treat this domain as confirmed malicious.

While the site is currently offline, the infrastructure may resurface under a new domain or IP. Network-level blocks should be maintained for the IP 216.198.79.65, and monitoring should extend to related domains registered through the same registrar or hosting provider. The explicit token presale theme indicates a financial scam, and users should be warned against engaging with similar crypto-related offers promoted via social media impersonation.