qu3-airdrop[.]pages[.]dev

Analysis of qu3-airdrop.pages.dev shows a domain created on February 21, 2026 and registered through Cloudflare, Inc. The site currently returns HTTP 403 and its page title is "Suspected phishing site | Cloudflare," indicating that it was flagged as malicious by Cloudflare's own protection services. The SSL certificate is issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain, confirming the use of Cloudflare's edge certificates. DNS resolution points to IP address 104.21.80.1, which belongs to AS13335 (Cloudflare, Inc.) and is located in the United States; the shared hosting nature of Cloudflare means the IP cannot be uniquely attributed to the threat actor. The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, and a Gridinsoft trust score of 0 out of 100 further reflects a lack of reputation.

VirusTotal scans report 7 detections out of 95 security vendors, corroborating the malicious classification. Detected technologies include HSTS, Cloudflare, and HTTP/3, all typical of Cloudflare-protected sites. The reported scam type is a "Fake Airdrop," aligning with the domain name and known threat landscape targeting cryptocurrency users.

While the site is presently taken offline, the indicators suggest it was actively used for credential or wallet harvesting. Defenders should immediately block the domain at the firewall or DNS level, update intrusion detection signatures to include the associated IP and TLS fingerprint, and monitor for similar subdomains leveraging Cloudflare infrastructure. Continuous threat‑intel feeds should be consulted for any resurgence, and incident response teams should be prepared to investigate any related phishing attempts that reference the same airdrop narrative.