presales-jessepollak[.]pages[.]dev

This domain is flagged as a confirmed phishing site targeting cryptocurrency users through a fraudulent token presale scheme. The page title $JESSE PRE-SALE explicitly indicates an attempt to impersonate a legitimate token offering, a common tactic to deceive victims into connecting wallets or divulging private keys under the pretense of early investment opportunities. Analysis indicates the domain is designed to harvest credentials or siphon funds through malicious smart contract interactions. Infrastructure analysis reveals the domain presales-jessepollak.pages.dev was registered on April 11, 2024, and is hosted on Cloudflare Pages, resolving to IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited by threat actors to lend credibility. Despite its active status, the domain appears on two security blocklists (PhishDestroy and ScamSniffer) but remains undetected by VirusTotal, with 0/95 engines flagging it as malicious. The combination of recent registration, cryptocurrency-themed deception, and low detection rates suggests an evolving threat with potential for rapid victim targeting. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.97.3) at the network perimeter. Users should be alerted to the specific threat of fake token presales, particularly those mimicking high-profile projects or individuals. Wallet providers and exchanges are advised to monitor for transactions linked to this domain or its associated smart contracts. If interaction has occurred, affected parties must revoke contract approvals, transfer assets to secure wallets, and report the incident to relevant fraud tracking platforms. Continuous monitoring for similar domains (e.g., variations of 'jessepollak' or 'presale') is recommended due to the likelihood of copycat attacks.