lucky-box-ph[.]pages[.]dev

Analysis of lucky-box-ph.pages.dev shows a newly registered domain (created March 29, 2026) hosted behind Cloudflare’s infrastructure. The domain resolves to IP 188.114.96.3, which is associated with Cloudflare, Inc. in Canada. The site serves over HTTPS with a certificate issued by Google Trust Services under the WE1 identifier and enforces HSTS. HTTP responses return status 200 and the page title is "Claim Your Reward!", matching the reported scam type of a fake airdrop. Detected technologies include Facebook Pixel, Cloudflare, and HTTP/3. Threat intelligence indicates that one of 94 VirusTotal scanners flagged the domain, Gridinsoft assigns a trust score of 0/100, and the domain appears on a single security blocklist. It is currently blocked by PhishDestroy and classified as high‑risk, with an active status. While the page content beyond the title has not been publicly dissected, the combination of a reward‑oriented title, fake‑airdrop labeling, and low trust scores suggests a credential‑harvesting or monetary‑extraction campaign. Defenders should add lucky-box-ph.pages.dev to URL filtering and domain‑blocking rules, monitor DNS queries for the associated IP, and enforce strict outbound traffic controls to prevent user interaction. Continuous re‑evaluation is advised as additional indicators may emerge.