# airdrop-5i9.pages.dev — SUSPICIOUS

> PhishDestroy identifies airdrop-5i9.pages.dev as an active ‘Airdrop Scam’ brand impersonation hosted behind Google Trust Services and Cloudflare. Hosting IP 188.

## Summary
PhishDestroy identifies airdrop-5i9.pages.dev as an active brand-impersonation site masquerading as a bogus crypto airdrop. This low-risk-yet-active campaign leverages Cloudflare Pages hosting and Google Trust Services SSL to appear legitimate, while presenting users with fraudulent wallet-connect prompts that harvest private keys and seed phrases.

This domain was flagged via seed c9b409 and resolves to IP 188.114.97.3. It was registered through Cloudflare, Inc. and secured with a Google Trust Services SSL certificate, showing 0 detections out of 95 scanners on VirusTotal at the time of analysis. No blocklist entries were recorded at this stage, indicating the threat is still in its early dissemination phase.

Users should avoid interacting with any airdrop link leading to airdrop-5i9.pages.dev. Verify any airdrop campaign directly via the project’s official website or social channels before connecting wallets. Enable wallet-screening features (e.g., MetaMask’s “blocklist” or Ledger’s “Revoke.cash” alerts) and report the domain to PhishDestroy via our public submission portal. Monitor connected wallets for unauthorized transactions and revoke suspicious approvals immediately.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Airdrop Scam

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/d4b49727-e6d7-4088-9b2a-b4d825cceb8d
- PhishDestroy: https://phishdestroy.io/domain/airdrop-5i9.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/airdrop-5i9.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/airdrop-5i9.pages.dev/
Last updated: 2026-04-01