limniferifyclaim[.]pages[.]dev

Analysis of limniferifyclaim.pages.dev, created on February 21, 2026 and registered through Cloudflare, Inc., shows a high‑risk brand‑impersonation infrastructure targeting Binance users with a fake airdrop lure. The domain resolves to IP 172.66.46.230, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. DNS is served by hal.ns.cloudflare.com and dalary.ns.cloudflare.com, confirming the use of Cloudflare’s edge network. The site presented an HTTPS certificate issued by Google Trust Services under the WE1 label, indicating a valid TLS handshake but offering no protection against the malicious content it hosted.

An HTTP request returns a 403 status, and the site is currently taken offline, yet historical evidence indicates it was active enough to be captured by multiple security blocklists. Five independent blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, have listed the domain as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of a fraudulent operation. VirusTotal scans show seven of ninety‑three security vendors flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat.

The page title observed during investigation—"Decentralized Dapps - We are unifying Web3 by providing best-in-class, self‑custodial, and multichain support"—does not reference Binance directly, but the known intelligence ties the site to a fake airdrop scheme impersonating the Binance brand. Detected technologies include HTTP/3, HSTS, and Cloudflare, suggesting a modern delivery stack. Defenders should block the domain at the network perimeter, add it to local deny lists, and monitor for any related indicators such as the associated IP address or Cloudflare nameservers. Ongoing threat‑intel feeds should be consulted for potential re‑use of the same infrastructure in future campaigns.