elonairdrop[.]pages[.]dev

The domain elonairdrop.pages.dev was registered on July 29 2025 via Cloudflare, Inc. It resolves to 104.21.64.1, an address owned by AS13335 Cloudflare, Inc. located in the United States. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS chain. HTTP responses return status 200 and the server advertises HSTS, Cloudflare and HTTP/3, with Chaport widget visible in the technology fingerprint. The page title observed is 'Elon Musk Bitcoin Airdrop', and the threat intelligence labels the campaign as a crypto‑related airdrop scam impersonating Bitcoin. The infrastructure matches the known 'Airdrop Scam' phishing kit. Reputation metrics are poor, with a Gridinsoft trust score of 0/100 and a Scamadviser score of 41/100. The domain appears on one security blocklist and has been blocked by PhishDestroy. VirusTotal scanning reports a single positive detection out of 93 vendors. The domain remains active as of the report date. Defenders should add the domain and its IP to block lists, monitor DNS queries for the associated Cloudflare nameservers (lila.ns.cloudflare.com, jonah.ns.cloudflare.com), and enforce email filtering rules for Bitcoin‑related keywords. Because the hosting is on a shared Cloudflare IP, any mitigation must target the specific hostname to avoid collateral impact. Continuous re‑scanning is advised to capture any changes in the detection profile.