claim-autodapp[.]pages[.]dev

Analysis of claim-autodapp.pages.dev indicates that the domain was created on February 21, 2026 and is hosted behind Cloudflare’s network (ASN 13335) with the resolved address 104.21.80.1 located in the United States. The domain was registered through Cloudflare, Inc., and the presented SSL certificate is issued by Google Trust Services under the WE1 profile, enforcing HSTS and HTTP/3. The site returned an HTTP 403 status before being taken offline, and its current status is recorded as offline. Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100), reflecting a high likelihood of malicious intent.

The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, and both have flagged it as a malicious resource. VirusTotal analysis shows that two of ninety‑five security vendors flagged the domain, reinforcing the suspicion. The page title observed, “Encrypted-Server – We are unifying Web3 by providing best‑in‑class, self‑custodial, and multichain support,” coupled with the declared scam type of a “Fake Airdrop,” suggests an attempt to lure victims with cryptocurrency incentives. The brand target is listed as “across,” indicating a broad impersonation strategy rather than a single brand focus.

Defenders should prioritize blocking the domain at the DNS and firewall layers, monitor for any residual traffic to the associated IP address, and update detection signatures to include the identified blocklist entries and the observed SSL fingerprint. Because the site is offline, immediate threat activity may have ceased, but the infrastructure – notably the Cloudflare‑protected IP and the associated nameservers (kenia.ns.cloudflare.com, jaziel.ns.cloudflare.com) – could be reused for future campaigns. Continuous vigilance is advised, especially for users receiving unsolicited airdrop offers that reference Web3 or blockchain services, as similar tactics have been employed in prior impersonation operations.