distribution-nanoeth[.]com

This domain, distribution-nanoeth.com, is currently under investigation for brand impersonation targeting Facebook. Analysis indicates the site masquerades as a legitimate entity, likely to facilitate credential theft or unauthorized account access. The page title, 'Home | UC San Francisco,' suggests an attempt to deceive users by mimicking an unrelated academic institution, while the underlying infrastructure appears designed to exploit trust in the Facebook brand. No crypto drainer kit signatures have been confirmed at this stage, but the domain exhibits characteristics consistent with credential harvesting campaigns. Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 0/95, indicating no antivirus engines have flagged the domain as malicious at the time of this report. The domain was registered on February 24, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 104.18.21.13, which is associated with Cloudflare’s content delivery network. The SSL certificate is issued by Let’s Encrypt, a common but not inherently malicious provider. Technologies detected on the site include Chart.js, Smartsupp, jsDelivr, and HTTP/3, which may be used to enhance functionality or evade detection. The domain appears on 3 security blocklists, including MetaMask, PhishDestroy, and SEAL, suggesting prior identification as a potential threat. Current status remains active, with no confirmed takedown or sinkholing actions. The risk level is classified as under investigation due to the lack of confirmed malicious payloads but the presence of multiple red flags, including the impersonation of Facebook and the use of Cloudflare to obscure hosting details. Users are advised to block the domain at the network level and monitor for any attempts to access it from internal systems. Security teams should treat any interaction with this domain as a potential compromise indicator, particularly if associated with Facebook login attempts or unexpected redirects. Further analysis is required to determine the full scope of the threat, including potential payload delivery mechanisms.