plume-airdrop-claim-strategy[.]pages[.]dev

The domain plume-airdrop-claim-strategy.pages.dev is a confirmed crypto drainer phishing site designed to steal cryptocurrency by tricking users into connecting their wallets. It does not impersonate a specific brand but uses the lure of a 'Plume Airdrop' to deceive victims. The site is currently taken offline, but it previously posed an elevated risk as a cryptocurrency scam.

Technical indicators confirm the malicious nature of plume-airdrop-claim-strategy.pages.dev. As of the latest scan, 3 of 95 VirusTotal security vendors flagged the domain for phishing. Google Safe Browsing also marked it with the 'SOCIAL_ENGINEERING' flag. The domain was registered through Cloudflare, Inc. on June 12, 2025, and resolves to the IP address 172.66.44.169, hosted by Cloudflare in the US. It appears on one security blocklist (PhishDestroy) and uses an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Plume Airdrop — Token Claim Strategy,' and the site employed technologies such as HSTS, Cloudflare, and HTTP/3. The current HTTP status is 403, indicating the site is no longer accessible.

Users who interacted with plume-airdrop-claim-strategy.pages.dev should immediately revoke any token approvals granted to the site to prevent further unauthorized transactions. It is recommended to move remaining funds to a new wallet and monitor transaction history for suspicious activity. Victims should also report the domain to their wallet provider and consider submitting it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to help prevent further scams.