stethcoin[.]pages[.]dev

This domain, stethcoin.pages.dev, is actively engaged in brand impersonation targeting cryptocurrency users through a fraudulent airdrop scheme. Analysis indicates the site mimics legitimate multi-chain airdrop platforms, specifically impersonating TrustPad under the page title 'Airdrops on TrustPad, The Exclusive Multi-Chain Airdrops.' No explicit drainer kit signatures were observed, but the domain aligns with known tactics used to deceive users into connecting wallets or disclosing private keys under false pretenses.

Technical indicators confirm the domain's malicious nature. VirusTotal reports 14 out of 95 security vendors flagging stethcoin.pages.dev as malicious. The domain resolves to IP address 172.66.45.17 and was registered on March 13, 2024, via Cloudflare Pages. Google Safe Browsing classifies the site as phishing, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare's infrastructure.

As of the latest verification, stethcoin.pages.dev remains active and unmitigated. No takedown requests or registrar enforcement actions have been observed. The domain continues to pose a high risk to users, particularly those seeking cryptocurrency airdrops. Recommended response actions include blocking the domain at the DNS or proxy level, updating endpoint protection rules to include the domain and associated IP, and alerting users to the presence of this fraudulent scheme. Persistent monitoring of related infrastructure is advised due to the likelihood of adversary pivoting to alternate domains.