ai-nodesyntax[.]pages[.]dev

The domain ai-nodesyntax.pages.dev was created on February 21, 2026 and is presently taken offline, returning an HTTP 403 status code. The site presented the page title "Blockchain Node - Multiverse support," which suggests an attempt to lure victims with a cryptocurrency‑related narrative. The domain is registered through Cloudflare, Inc. and uses Cloudflare’s DNS resolvers (kenia.ns.cloudflare.com and jaziel.ns.cloudflare.com). Network analysis shows the domain resolves to IP address 172.66.47.120, an address owned by AS13335 Cloudflare, Inc. located in the United States.

SSL is provided by Google Trust Services under the WE1 certificate, indicating a valid TLS chain but offering no assurance of legitimacy. Security telemetry indicates the site was flagged by PhishDestroy and appears on one external blocklist. VirusTotal scans recorded two detections out of ninety‑three antivirus engines, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. Detected technologies include HTTP/3, HSTS, and Cloudflare’s edge services, all of which are common in abuse infrastructure but do not mitigate the underlying threat.

The domain is classified as a "Fake Airdrop" campaign and is noted to impersonate the brand "across," implying that victims may be presented with a counterfeit airdrop offer tied to that brand. Because the site is currently inaccessible, content‑level analysis is limited; however, the combination of a brand‑impersonation label, a cryptocurrency‑oriented page title, and multiple security detections strongly supports the conclusion that the domain was used for brand impersonation and fraudulent airdrop distribution. Defenders should add the domain and its associated IP address to deny‑list rules, monitor for any future DNS resolution to the same IP range, and enforce strict verification of any airdrop communications claiming to originate from the "across" brand.