reclaimcrypto[.]pages[.]dev

This domain, reclaimcrypto.pages.dev, was registered on March 26 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.131, which is owned by Cloudflare in Canada. The domain is served over HTTPS by a Google Trust Services / WE1 certificate and returns HTTP 200 with HSTS enabled. DNS is hosted on Cloudflare nameservers elijah.ns.cloudflare.com and rosalyn.ns.cloudflare.com. Automated analysis shows the site is built with Bootstrap and delivers content via HTTP/3 under Cloudflare’s edge network. The page title observed is “Reclaim Crypto”, and the campaign is classified as a “Fake Airdrop” that impersonates Cloudflare, a clear brand‑impersonation attempt. Reputation services assign extremely low trust scores (Gridinsoft 0/100, Scamadviser 1/100). The domain is listed on a single blocklist and is actively blocked by PhishDestroy. VirusTotal reports 2 of 94 scanners flagging the domain, indicating some malicious indicators. The threat is rated high and the campaign remains active. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content has been publicly disclosed. Defenders should block the domain and its associated IP, monitor traffic to Cloudflare edge nodes for anomalous requests, and incorporate the observed indicators—domain name, IP, SSL fingerprint, and nameserver pair—into detection rules. Continued observation is advised to capture any evolution of the payload.