zcorkr[.]pages[.]dev

This domain is flagged as a high-risk cryptocurrency presale phishing site targeting users with fraudulent token sale offers. Analysis indicates the page title "币安人生 | Presale" mimics legitimate exchange branding to deceive victims into connecting wallets or transferring funds to attacker-controlled addresses. The threat type is classified as generic_phishing with a focus on cryptocurrency fraud, a common vector for financial theft in decentralized ecosystems. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on December 8, 2025, and resolves to the IP address 172.66.47.127, a Cloudflare-hosted endpoint. Despite its recent creation, the domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, suggesting active malicious use. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited by threat actors to lend credibility. Notably, VirusTotal reports 0/95 detections, indicating the campaign may still evade some automated detection systems due to its novelty or obfuscation techniques. Mitigation requires immediate blocking of the domain and associated IP at network and endpoint levels. Users should be warned against interacting with unsolicited presale offers, particularly those mimicking exchange branding. Wallet providers and cryptocurrency platforms are advised to flag the domain in transaction validation systems to prevent fund transfers. Security teams should monitor for related infrastructure, such as newly registered domains under Cloudflare Pages or similar hosting services, and correlate with known phishing patterns targeting cryptocurrency users. Verification of presale legitimacy through official channels is critical to avoid financial loss.