claim-punch[.]pages[.]dev

This domain, claim-punch.pages.dev, is actively engaged in brand impersonation targeting Revolut, a financial services platform. Analysis confirms the threat type as a fraudulent airdrop scheme designed to deceive users into interacting with malicious smart contracts or disclosing sensitive credentials. The domain remains operational as of the latest assessment, posing an ongoing risk to unsuspecting visitors. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 8 of 95 security vendors on VirusTotal, with additional detections across four independent blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. Registered through Cloudflare, Inc. on February 22, 2026, the domain resolves to the IP address 172.66.44.207, associated with Cloudflare’s AS13335 network in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious domains leveraging Cloudflare’s infrastructure. The page title, 'PUNCH | Airdrop,' further corroborates the fraudulent intent, as it mimics promotional campaigns to lure targets. Current status indicates the domain is still active, with no evidence of takedown or mitigation. Users and organizations are advised to implement immediate blocking measures at the network and endpoint levels, including DNS filtering and browser-based protections. Security teams should monitor for related indicators of compromise, such as wallet drainer scripts or credential harvesting attempts linked to this infrastructure. Given the high-risk classification and confirmed brand impersonation, all interactions with this domain should be treated as malicious until further notice.