claim-free-airdrop[.]pages[.]dev

This domain, claim-free-airdrop.pages.dev, operates as an active brand impersonation scheme designed to deceive users into participating in a fraudulent cryptocurrency airdrop. The page mimics the legitimate Pi Network platform, presenting itself under the title 'Pi Network Airdrop' to exploit trust in the brand. Analysis indicates the site likely functions as a crypto drainer, tricking victims into connecting wallets or submitting sensitive credentials under the guise of claiming free tokens. The campaign poses a high risk to users unfamiliar with common airdrop scam tactics, particularly those engaging with decentralized finance (DeFi) or emerging blockchain projects. Infrastructure analysis reveals the domain was registered on February 04, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.46.211, hosted on Cloudflare's network (AS13335). Detection metrics show limited but concerning coverage, with only 1 of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on a single security blocklist, suggesting early-stage detection or evasion techniques. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy while obscuring the underlying malicious infrastructure. Users who visited claim-free-airdrop.pages.dev should immediately revoke any wallet permissions granted to the site and monitor connected accounts for unauthorized transactions. If credentials or recovery phrases were entered, affected parties must transfer assets to a new, secure wallet and enable multi-factor authentication on all related accounts. Security teams are advised to block the domain and IP 172.66.46.211 at the network level to prevent further exposure. Continued monitoring of similar Cloudflare-hosted pages with recent creation dates is recommended, as this pattern aligns with common phishing campaign infrastructure.