cleanshitcoin[.]site

This domain, cleanshitcoin.site, is flagged as a brand impersonation threat specifically targeting DexScreener, a cryptocurrency analytics platform. Analysis indicates the site masquerades as a legitimate crypto service, using a fabricated narrative about earning cryptocurrency through unrelated activities to lure victims. The threat type is classified as brand impersonation, with no direct evidence of a crypto drainer kit or credential theft mechanisms observed at the time of analysis, though the impersonation tactic suggests potential for secondary exploitation vectors. Infrastructure analysis reveals the domain was registered on August 29, 2025, through Go Daddy, LLC, and resolves to the IP address 75.2.60.5. It is detected by 3 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and is blocked by PhishDestroy. Technologies detected include Netlify for hosting and HSTS implementation, while the SSL certificate is issued by Let's Encrypt. No association with Google Safe Browsing (GSB) was recorded at the time of assessment. As of the latest verification, cleanshitcoin.site has been taken offline, likely due to enforcement actions by hosting providers or security entities. However, the elevated risk persists due to the domain's recent registration and prior impersonation activity. Organizations and users are advised to monitor for similar domains leveraging the same brand impersonation tactics, particularly those using fabricated crypto-related narratives. Blocking the domain and associated IP at the network level is recommended as a preventive measure. Continuous vigilance is required, as threat actors may re-establish infrastructure under new domains or IPs.