2e5d2a5f-8de6-47f0-baa1-27e72817d50c[.]pages[.]dev

This domain is actively engaged in brand impersonation targeting cryptocurrency users through a fraudulent airdrop checker interface. The page, titled 'Aired— Airdrop Checker. Find Crypto Airdrops 🪂,' mimics legitimate airdrop verification tools to deceive victims into disclosing wallet credentials or transferring funds under false pretenses. Analysis indicates the threat is designed to exploit the growing interest in crypto airdrops, a common vector for financial scams in the digital asset space.

Infrastructure analysis reveals the domain was registered through Cloudflare Pages on June 09, 2026, and currently resolves to the IP address 172.66.47.70. Detection metrics show limited but concerning coverage, with 2 out of 95 security vendors flagging the domain on VirusTotal. Additionally, the domain appears on two independent security blocklists, further corroborating its malicious nature. The SSL certificate is issued by Google Trust Services, a detail that may lend an appearance of legitimacy to unsuspecting users.

Users who have visited this domain should immediately cease all interactions and revoke any permissions granted to connected wallets or applications. It is recommended to monitor financial accounts for unauthorized transactions and consider resetting credentials for any platforms accessed during the visit. Security teams are advised to update blocklists with the domain and associated IP to prevent further exposure within their networks.