notcoin[.]pages[.]dev

This domain operates as a high-risk brand impersonation scheme targeting cryptocurrency users through a fraudulent airdrop offer. The page, titled 'NotCoin Airdrop by Telegram,' falsely presents itself as an official distribution event for NotCoin tokens, a known cryptocurrency project. Victims are likely lured into connecting wallets or divulging private keys under the pretense of claiming rewards, which may result in unauthorized fund transfers or account compromise. The threat specifically exploits the popularity of airdrops in the crypto community, where users frequently engage with such promotions without verifying authenticity. Analysis indicates the domain was registered on April 14, 2026, through Cloudflare Pages, a platform often leveraged for rapid deployment of malicious infrastructure. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged by security vendors. The domain resolves to IP address 172.66.44.84, hosted by Cloudflare, Inc. in California, and is currently present on three security blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy, as encrypted connections are commonly associated with trustworthy sites. Users who have interacted with notcoin.pages.dev should immediately disconnect any connected wallets and revoke permissions granted to unknown smart contracts. If private keys or recovery phrases were entered, affected wallets should be considered compromised, and funds should be transferred to a new, secure wallet. Monitoring for unauthorized transactions is critical, and users are advised to report the domain to relevant security teams for further mitigation. The domain remains active, and continued vigilance is recommended for those who may have engaged with the fraudulent offer.