Skip to content
Scammers.com
Crypto, investment & PonziReviewed

1dollartrump.com 'Trump $1 Coin' presale page flagged as phishing

Anti-phishing project PhishDestroy posted on Mastodon on 10 November 2026 that 1dollartrump[.]com is a phishing detection. PhishDestroy recorded the page promoting a "Trump $1 Coin" presale with a buy button, roadmap…

First reported
Reports
1

Source: mastodon.social · published

Screenshot of the 1dollartrump.com Trump $1 Coin presale page
Image: PhishDestroy (via Mastodon)

What happened

Anti-phishing project PhishDestroy posted on Mastodon on 10 November 2026 that 1dollartrump[.]com is a phishing detection. PhishDestroy recorded the page promoting a "Trump $1 Coin" presale with a buy button, roadmap and tokenomics sections. PhishDestroy rated the domain medium risk (25/100), no VirusTotal engines flagged it in the scan PhishDestroy stored, and it is not on the Phishing Army blocklist. Donald Trump's name is being used; there is no indication he or any official body is involved. Crypto presale pages that borrow famous names are a common way to take payments or wallet approvals.

How the scam works

PhishDestroy recorded 1dollartrump.com promoting a "Trump $1 Coin" presale with a buy button. PhishDestroy rated the domain medium risk (25/100), no VirusTotal engines flagged it in the scan PhishDestroy stored, and it is not on the Phishing Army blocklist. Celebrity- or politician-branded crypto presale pages commonly ask visitors to connect a wallet, send cryptocurrency to a presale address, or complete a registration form. Payments and wallet approvals are difficult to reverse, and there is often no genuine token or refund.

Donald Trump's name is being used; there is no indication he or any official body is involved. Treat a presale that leans on a famous name, especially on a newly flagged domain, as high risk unless you can verify it through official channels independent of the site itself. The detection comes from a single PhishDestroy record.

Source

Public post on Mastodon, 10 November 2026: https://mastodon.social/@phishdestroy/117592001993090127

The indicators come from this source and have not been independently checked by scammers.com.

Red flags

  • A crypto presale that uses a politician's or celebrity's name.
  • A buy button, roadmap and tokenomics page that is not on an official campaign or government site.
  • A request to connect a wallet or send cryptocurrency to a presale address.
  • A domain with only a thin public record and no independent official confirmation.

If you were targeted

  1. 1Do not connect a wallet or send funds because a celebrity-branded presale page asked you to.
  2. 2Verify any official digital asset announcement through channels independent of the site.
  3. 3If you paid or approved a transaction, contact your exchange or wallet support and, if a card was used, your bank.
  4. 4Report the page to a national cyber reporting service.
  5. 5Treat unsolicited presale ads that lean on a famous name as high risk.

Fake Zerion crypto-wallet site zerion-inc.webflow.io flagged as phishing

Anti-phishing project PhishDestroy posted on Mastodon on 12 November 2026 that zerion-inc[.]webflow[.]io is a suspected phishing site. Its domain record shows a page copying Zerion's wallet homepage ("Crypto Wallet fo…

  • zerion-inc.webflow.io
  • Webflow subdomain; VirusTotal 17/92; URLScan brand: Zerion
  • Crypto wallet phishing, drainers and address-poisoning cluster (12 Nov 2026)
Reported Nov 12, 20261 report
PhishingReviewed

GMX.net email login phishing page at xncok12.weebly.com

PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…

  • xncok12.weebly.com
  • Weebly subdomain; VirusTotal 17/92
Reported Nov 12, 20261 report

Wallet-drainer page multi-xchange.firebaseapp.com poses as WalletLink connection service

ScanMalware posted on X on 12 November 2026 that multi-xchange[.]firebaseapp[.]com is a confirmed scam. Its scan report describes a wallet-drainer phishing page posing as WalletLink, a wallet-connection brand, on a fr…

  • multi-xchange.firebaseapp.com
  • Firebase subdomain; Telegram bot token in page script
  • Crypto wallet phishing, drainers and address-poisoning cluster (12 Nov 2026)
Reported Nov 12, 20261 report

MalwareTips: household-goods store deniudy.com in scam network, flagged by 5 VirusTotal vendors

MalwareTips published an investigation today rating deniudy.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new na…

  • deniudy.com
  • Part of a scam network of near-identical dropshipping stores (MalwareTips)
  • MalwareTips fake or copycat store cluster (12 Nov 2026)
Reported Nov 12, 20261 report