claim-plume-1lu[.]pages[.]dev

Analysis indicates that the domain claim-plume-1lu.pages.dev was provisioned on February 21 2026 and is currently offline. The site was hosted behind Cloudflare (AS13335) in the United States, resolving to 172.66.47.192. The domain uses a Google Trust Services certificate (WE1) and supports HSTS and HTTP/3, confirming modern TLS configuration. The page title returned by the server is “Plume Airdrop”, and the site was identified as employing the publicly known “Airdrop Scam” phishing kit, which typically harvests cryptocurrency wallet seeds. Google Safe Browsing has flagged the URL for social engineering, and PhishDestroy has added it to its blocklist.

The domain appears on a single external security blocklist, and ten of ninety‑three VirusTotal scanners reported malicious activity, reinforcing the suspicion of credential‑stealing behavior. Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of credibility. The nameservers yahir.ns.cloudflare.com and naomi.ns.cloudflare.com are standard Cloudflare delegations, offering no additional attribution. The HTTP response is 403, which may be a result of the host takedown after detection.

The primary uncertainty is the exact content of the landing page, as no visual analysis is available; however, the combination of the “Plume Airdrop” title, the Discord impersonation tag, and the wallet/seed phishing kit strongly suggests a targeted attempt to lure Discord users into submitting private keys under the pretense of an airdrop. Defenders should immediately block the domain at the DNS and proxy layers, monitor for any outbound connections to the IP 172.66.47.192, and add hashes of any observed payloads to internal detection rules. Incident response teams should also alert end‑users to the fraudulent “Discord Airdrop” narrative and advise against providing wallet seeds to any unsolicited request.