lenspresale[.]xyz

Analysis indicates that lenspresale.xyz is an active malicious site delivering a fake Lens token presale airdrop. The domain was registered on 2025-11-03 through Ultahost, Inc. and resolves to IP 45.12.2.67, which is hosted by Virtual Systems LLC in Ukraine. The authoritative nameservers ns1.lenspresale.xyz and ns2.lenspresale.xyz are self‑served, suggesting the operator controls the DNS zone. The web server presents a valid Let's Encrypt R12 certificate but runs Plesk on Nginx with Tailwind CSS, a common stack for quickly deployed phishing pages. Gridinsoft assigns a trust score of 0/100 and the domain appears on one security blocklist; PhishDestroy has already listed it as blocked. VirusTotal reports five of ninety‑one scanners flagging the host, reinforcing the malicious assessment. The page title explicitly references “Lens (LENS) Token Presale – Powering Decentralized Social Identity,” indicating an attempt to lure users interested in the Lens ecosystem. No additional content has been examined, so the full extent of credential or wallet harvesting capabilities remains unknown. Defenders should immediately block resolution of lenspresale.xyz at network and endpoint layers, add the IP 45.12.2.67 to deny‑list rules, and monitor for similar Lens‑related impersonation campaigns. Continuous re‑scanning of the domain and its infrastructure is advised to capture any changes in payload or hosting.