wllt-reward[.]pages[.]dev

The domain wllt-reward.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.224, which belongs to AS13335 operated by Cloudflare in the United States. The site served a page titled “Get Your Rewards!” and is linked to a fake‑airdrop campaign that promises cryptocurrency rewards in exchange for personal information. VirusTotal analysis indicates the page was scanned by 93 antivirus engines without any detections, but the absence of flags does not constitute proof of safety. The domain appears on a single security blocklist, specifically PhishDestroy, confirming that at least one reputable phishing feed has flagged it as malicious.

No SSL certificate is presented, meaning the connection is unencrypted and susceptible to interception. Current status is offline, suggesting the site has been taken down or is no longer serving content. Infrastructure analysis shows the use of Cloudflare’s CDN to obscure the true hosting environment, a technique commonly employed by phishing and scam operators to hinder attribution.

Defenders should add the domain and its associated IP address to internal blocklists, monitor for re‑registration or the emergence of similar sub‑domains, and enforce strict verification of any unsolicited airdrop communications targeting users. Because the original page content has not been publicly archived, further forensic analysis of the HTML, scripts, or credential‑capture mechanisms is advisable if the site becomes active again. Until additional evidence is gathered, the domain should be treated as a high‑confidence fake‑airdrop threat.