claimdjt[.]pages[.]dev

The domain claimdjt.pages.dev is currently flagged for brand_impersonation, specifically targeting users with a fraudulent TrumpCoin airdrop scheme. Analysis indicates the site remains active, presenting itself as a legitimate token distribution platform to deceive victims into connecting wallets or disclosing private keys. Infrastructure analysis reveals the domain was registered on July 31, 2024, through Cloudflare, Inc. and resolves to the IP address 172.66.47.107, hosted under AS13335. The SSL certificate is issued by Google Trust Services (WE1), and the page title explicitly states 'Join the TrumpCoin Airdrop and Get your tokens!' Despite its malicious intent, the domain has not been flagged by any of the 95 VirusTotal vendors as of the latest scan. It appears on one security blocklist and is currently classified as under investigation. The domain poses a significant risk of crypto asset theft, as it likely employs social engineering tactics to trick users into interacting with malicious smart contracts or draining mechanisms. Organizations and individuals are advised to block the domain and associated IP at the network level. Security teams should monitor for wallet connections originating from this domain and educate users about the risks of unverified airdrop promotions. If encountered, victims should immediately revoke any connected wallet permissions and report the incident to relevant fraud authorities.