gmi-6cf[.]pages[.]dev

This domain, gmi-6cf.pages.dev, is flagged as an active phishing site targeting users with a fake airdrop scam. Analysis indicates the domain was registered on June 13, 2026, and currently resolves to IP 172.66.44.154, hosted on Cloudflare infrastructure in Canada. The page title explicitly states 'GonnaMakeIt Airdrop,' aligning with the reported scam type. Infrastructure analysis reveals the use of Cloudflare nameservers (desi.ns.cloudflare.com, vasilii.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). Technologies detected include HSTS, crypto-js, cdnjs, and HTTP/3, which are consistent with modern phishing kits designed to evade detection. The domain appears on at least one security blocklist and is flagged by 2 of 91 vendors in a recent scan, though the exact nature of these detections remains unverified. No specific brand impersonation beyond the 'GonnaMakeIt' reference is confirmed, and the content of the site has not been analyzed for additional indicators. Defenders should treat this domain as high-risk, particularly in environments where cryptocurrency or airdrop-related activities are common. Immediate blocking at the DNS or network level is recommended, alongside monitoring for related domains leveraging similar naming conventions or infrastructure.