www-riverxyzairdrop[.]pages[.]dev

As of July 29, 2026, www-riverxyzairdrop.pages.dev has been identified as an active crypto drainer threat. The domain resolves to IP address 188.114.96.3 and was initially created on September 2, 2020. Current intelligence shows the domain is flagged by both PhishDestroy and ScamSniffer, appearing on two separate security blocklists, indicating ongoing malicious activity. VirusTotal scan results reveal that 4 out of 91 security vendors detect this domain as dangerous, with specific evidence linking it to crypto drainer operations. The domain is registered via Cloudflare Pages, which is commonly used for rapid deployment of web infrastructure and can complicate attribution and takedown procedures.

The detection from multiple blocklists and security vendors confirms elevated risk, especially for users involved in cryptocurrency transactions. While the infrastructure and registration details are documented, the actual web content has not yet been analyzed, so the specific methods used for draining crypto assets remain unclear. No additional data is available regarding SSL configuration, HTTP status, or brand targeting, and there is no information on further detections from sources such as OTX or Safe Browsing.

Given the confirmed threat type and active status, network defenders should immediately block www-riverxyzairdrop.pages.dev at the perimeter and monitor for related activity originating from IP 188.114.96.3. Continued surveillance of this infrastructure is recommended to detect potential pivots or related domains that may arise. Users should be warned against interacting with this domain due to clear evidence of crypto drainer functionality.