apemars-claim-presale-launch-oees33-aert0ds[.]pages[.]dev

The domain apemars-claim-presale-launch-oees33-aert0ds.pages.dev is actively distributing a crypto drainer targeting users of the $APRZ token presale. Analysis confirms this infrastructure impersonates the official APEMARS presale claim page, tricking victims into connecting cryptocurrency wallets to malicious smart contracts designed to siphon funds. The page title, APEMARS Presale Claim – Official $APRZ Claim Page, explicitly mimics legitimate promotional materials, increasing the likelihood of successful social engineering attacks against presale participants. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on June 06, 2026, and currently resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. Detection metrics indicate limited but growing awareness, with 3 of 95 security vendors on VirusTotal flagging the domain as malicious. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust validation beyond standard encryption. The domain appears on 2 security blocklists and is actively blocked by at least two specialized threat intelligence platforms, including PhishDestroy and ScamSniffer. Current status confirms the domain remains operational, posing a high risk to users engaging with $APRZ presale promotions. Recommendations include immediate blacklisting of the domain and IP across all organizational security controls. Users should verify presale claims exclusively through official project channels, enable transaction simulation tools to preview smart contract interactions, and deploy wallet protection mechanisms such as hardware wallets or isolated software environments. Network defenders are advised to monitor for connections to 188.114.97.3 and implement real-time blocking of newly observed domains registered under Cloudflare Pages exhibiting similar naming patterns or impersonating cryptocurrency presales.