thesofaairdrop[.]pages[.]dev

This domain, thesofaairdrop.pages.dev, operates as a high-risk brand impersonation scheme designed to deceive users into participating in a fraudulent airdrop. The page mimics the legitimate Multichain cross-chain router protocol, presenting itself under the title 'Multichain - Cross-Chain Router Protocol' to exploit trust in the targeted brand. Analysis indicates the site is engineered to harvest cryptocurrency wallet credentials or private keys under the guise of distributing tokens, a common tactic in airdrop scams. The threat is particularly acute for users familiar with cross-chain platforms, as the site’s design and branding closely resemble authentic Multichain interfaces, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered through Cloudflare Pages on June 9, 2026, and currently resolves to the IP address 172.66.44.144. It is flagged by 14 out of 95 security vendors on VirusTotal, with additional detections from two security blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but does not mitigate the underlying fraudulent activity. The domain remains active despite being blocked by multiple detection systems, suggesting ongoing efforts to evade countermeasures. Users who have visited thesofaairdrop.pages.dev should immediately cease all interaction with the site and revoke any permissions granted to connected cryptocurrency wallets. It is critical to audit wallet transactions for unauthorized activity, particularly those involving token transfers or contract interactions. If credentials or private keys were entered, affected users must transfer assets to a new, secure wallet and monitor for signs of compromise. Additionally, reporting the domain to relevant security platforms and cryptocurrency service providers can aid in mitigating further risk to the broader user base.