pretiummarginpresale-updated[.]pages[.]dev

This domain, pretiummarginpresale-updated.pages.dev, is flagged as an active credential phishing site impersonating financial services under the guise of "Pretium Margin." Analysis indicates the page is designed to harvest user credentials, likely targeting individuals involved in margin trading or investment platforms. No direct association with known crypto drainer kits or specific brand impersonation frameworks has been confirmed at this stage, though the naming convention suggests an attempt to mimic legitimate financial services. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on June 09, 2026, and currently resolves to the IP address 188.114.96.3. As of the latest scan, the domain has a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it yet. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare infrastructure. The domain appears on one security blocklist, suggesting early detection by at least one threat intelligence feed, though broader awareness remains limited. The site remains active and operational, posing an ongoing risk to users who may be deceived by its financial-themed branding. Response actions have been initiated by at least one security provider, though the lack of broader detection highlights the need for continued monitoring. Organizations and individuals are advised to block the domain at the network level and alert users to the potential for credential theft. Given the domain’s recent registration and low detection rate, further investigation into associated infrastructure and threat actor patterns is recommended to preempt additional campaigns.