bestwalletpresale[.]com

Analysis of bestwalletpresale.com confirms it as an active crypto presale scam targeting the Across protocol brand. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to Cloudflare IP 172.67.69.208 (AS13335, US). Infrastructure analysis reveals Cloudflare nameservers (eugene.ns.cloudflare.com, michelle.ns.cloudflare.com) and MX records pointing to eforward1.registrar-servers.com, a pattern consistent with phishing domains leveraging third-party email forwarding. The site's page title, '$BEST Token Presale: Best Crypto Presale & Coin Launch 2025,' explicitly promotes a fraudulent token presale, aligning with the 'brand_impersonation' threat type specified in the intelligence. Technical indicators include a 307 HTTP redirect status, a WE1 SSL certificate, and detected technologies such as Node.js, React, Next.js, and Google Tag Manager, which are commonly used in both legitimate and malicious sites but provide no inherent proof of fraud. The domain appears on one security blocklist (PhishDestroy) and is flagged by one of 93 vendors on VirusTotal, though the specific detection context is not detailed. No evidence suggests the site has been taken down, and it remains accessible as of July 12, 2026. Defenders should prioritize blocking the domain and associated IP (172.67.69.208) at the network level, while monitoring for related infrastructure, such as the registrar-servers.com email forwarding service. The Across protocol team should be notified to assess potential trademark infringement. Given the domain's recent registration and active status, further investigation into its hosting and traffic sources is recommended to identify linked campaigns or additional impersonation domains.