rwrds-airdrop-nft[.]pages[.]dev

rwrds-airdrop-nft.pages.dev is an active crypto‑scam site that pretends to be associated with Ethereum. The domain was registered on 3 Nov 2025 through Cloudflare and resolves to 172.66.44.141, an address owned by AS13335 Cloudflare, Inc. The hosting employs Cloudflare services, presenting HSTS and HTTP/3 support and presenting an SSL certificate issued by Google Trust Services (WE1). DNS is served by alexandra.ns.cloudflare.com and burt.ns.cloudflare.com. HTTP requests return status 200 and the page title reads “Airdrop Eligibility Check”, indicating an airdrop eligibility check flow commonly used in Ethereum‑related scams. The site is classified as a “Crypto Scam” and uses the publicly known “Airdrop Scam” phishing kit. Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0 / 100, five of ninety‑five VirusTotal scanners flag the domain, and it appears on at least one security blocklist. PhishDestroy has already blocked the domain, yet it remains reachable. The evidence confirms deliberate brand impersonation of Ethereum for fraudulent airdrop claims. Defenders should add the domain to blocklists, monitor Cloudflare‑associated IP ranges for similar activity, and enforce email or web gateway policies that detect the “Airdrop Eligibility Check” pattern. Further analysis of the page content is required to determine any credential‑harvesting forms or malicious payloads, but the current infrastructure evidence is sufficient to treat the domain as high‑risk.