thenotc0in[.]pages[.]dev

PhishDestroy identifies thenotc0in.pages.dev as an active high-risk phishing domain currently impersonating the legitimate Notcoin cryptocurrency token. This campaign specifically targets cryptocurrency users by mimicking Notcoin’s branding to deceive visitors into connecting wallets or transferring funds to attacker-controlled addresses. The domain remains operational despite multiple security interventions, posing an immediate threat to unsuspecting investors engaging with purported Notcoin-related services. This domain was flagged by 1 out of 95 VirusTotal security vendors, indicating limited but confirmed malicious detection. Registered through Cloudflare, Inc., it resolves to IP address 172.66.47.131 and holds a valid SSL certificate issued by Google Trust Services, which may contribute to false trust among visitors. The page has been blocked by MetaMask and SEAL security systems and appears on 2 independent security blocklists, demonstrating cross-platform recognition of its fraudulent nature. Despite these indicators, the domain continues to operate actively as of the latest assessment. The current status of thenotc0in.pages.dev remains active and unmitigated, requiring immediate action from domain registries, hosting providers, and end-users. Security teams should block this domain at network and endpoint levels using the IP address 172.66.47.131 and domain name thenotc0in.pages.dev. Cryptocurrency users should verify all Notcoin-related links through official sources such as the project’s verified website or social media channels before engaging. Report this domain to your security vendor and consider sharing telemetry to improve collective defense against this active phishing campaign.