kyberswapairdrop[.]pages[.]dev

The domain kyberswapairdrop.pages.dev was registered on December 16, 2024 through Cloudflare, Inc. It resolves to IP address 172.66.44.110, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are rita.ns.cloudflare.com and lakas.ns.cloudflare.com. The site presents a TLS certificate issued by Google Trust Services / WE1, and the observed HTTP response is a 500 error with the page title "Worker threw exception | kyberswapairdrop.pages.dev | Cloudflare". Infrastructure analysis shows the presence of HSTS, Cloudflare, and HTTP/3. The domain is currently listed on two security blocklists and has been blocked by PhishDestroy and ScamSniffer. It is classified as a brand_impersonation campaign targeting Cloudflare and employs an Airdrop Scam kit, indicating a cryptocurrency‑focused phishing attempt. The risk level is marked under_investigation, and the campaign remains active. While the site does not currently exhibit malicious payloads in public scans, the combination of brand impersonation, use of a known scam kit, and active blocklist entries suggests a credible threat. Defenders should continue to monitor the domain, enforce blocklist rules, and consider network‑level filtering for traffic to the associated IP range. Additional analysis of any payloads delivered after the initial exception page is recommended to confirm the presence of malicious code or credential‑harvesting forms.