rwaconnect-claim-airdrop-trump-coin-meme-doge-btc-eth[.]pages[.]dev

Analysis of the domain rwaconnect-claim-airdrop-trump-coin-meme-doge-btc-eth.pages.dev shows a clear pattern of a crypto‑drainer operation that was taken offline as of the report date. The domain was registered on February 21, 2026 through Cloudflare, Inc., and it resolves to the IP address 172.66.45.48, which is hosted by Cloudflare (AS13335) in the United States. The TLS certificate presented by the site is issued by Google Trust Services under the WE1 certificate authority, indicating a valid HTTPS endpoint, but the page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting the content is blocked or unavailable. DNS resolution uses the Cloudflare nameservers sterling.ns.cloudflare.com and norah.ns.cloudflare.com, and the site employs HSTS and HTTP/3, confirming modern web infrastructure.

Security telemetry shows that the domain appears on two blocklists and has been flagged by PhishDestroy and ScamSniffer, with a Gridinsoft trust score of 0 out of 100. VirusTotal analysis reports that 7 of 93 scanning engines flagged the domain, reinforcing the malicious classification. The identified scam type is a fake airdrop, commonly used to lure victims into disclosing cryptocurrency wallet credentials or transferring funds to attacker‑controlled addresses.

Uncertainty remains around the exact payload or phishing page content because the site returned a 403 status and no further content was captured. Defenders should block the domain at DNS and proxy layers, monitor for any outbound connections to the associated Cloudflare IP range, and update endpoint detection rules to include the observed certificate issuer and HTTP status pattern. Continuous monitoring of the listed blocklists and VirusTotal detections is recommended to capture any re‑registration attempts or related infrastructure that may appear in future campaigns.