presales-monprotocolapp[.]pages[.]dev

Analysis of presales-monprotocolapp.pages.dev shows an active infrastructure used for a crypto‑drainer campaign. The site is hosted on Cloudflare Pages and resolves to the Cloudflare‑owned address 188.114.96.3, which is geolocated to Canada. Registration data indicate the domain was created on 28 February 2024 and the TLS certificate is issued by Google Trust Services under the WE1 profile, providing a valid HTTPS connection. HTTP response code 200 and HSTS header confirm the server is reachable and enforces secure transport. Automated scanners have identified a suite of client‑side libraries including Unpkg, SweetAlert2, jsDelivr, crypto‑js, cdnjs and HTTP/3 support, suggesting a typical modern web stack. Reputation services PhishDestroy, ScamSniffer and Enkrypt have listed the domain, and three independent blocklists also contain it. VirusTotal analysis reports 13 of 91 security vendors flag the domain, while Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The page title “MON Protocol Community Presale” aligns with the declared scam type of a crypto drainer, indicating an attempt to lure victims into sending cryptocurrency. No additional evidence about the exact phishing flow or credential collection mechanism is available. Defenders should add the domain to blocklists, enforce DNS filtering, and monitor outbound connections to the associated IP address. Continuous updates to detection signatures are advised, and any inbound traffic matching the observed TLS fingerprint or HTTP headers should be inspected or dropped.