bestwallettoken-sales[.]pages[.]dev

This domain, bestwallettoken-sales.pages.dev, is flagged as an active crypto drainer phishing site targeting cryptocurrency users through a fraudulent token presale. Registered on April 4, 2026, and hosted on Cloudflare infrastructure, it resolves to IP 172.66.45.26 with nameservers aspen.ns.cloudflare.com and javier.ns.cloudflare.com. The page title, 'Best Wallet Token - Crypto Presale,' suggests an attempt to impersonate a legitimate token sale, aligning with the 'brand impersonation' classification noted in available intelligence. Analysis indicates the domain remains operational with an HTTP 200 status, and it is blocked by at least one security blocklist. Six of 94 security vendors on VirusTotal have flagged the domain, though the specific detection rules or signatures are not detailed in current data. The SSL certificate is issued by Google Trust Services, which does not inherently indicate malicious activity but is consistent with the domain's use of Cloudflare services. Defenders should treat this domain as high-risk due to its confirmed crypto drainer classification and active status. Recommended actions include blocking resolution at the DNS level, updating web filtering rules to prevent user access, and monitoring for related domains using the same Cloudflare nameservers or IP range. The exact wallet addresses or drainer scripts associated with this domain are not currently available in the provided intelligence, so additional forensic analysis of network traffic or endpoint logs may be required to identify compromised transactions linked to this campaign.