momoairdrop[.]pages[.]dev

Analysis of momoairdrop.pages.dev indicates that the site is currently offline but retained in at least one security blocklist. The domain was registered on 21 February 2026 via Cloudflare, Inc., and the WHOIS record shows Cloudflare as the registrar. No TLS certificate is associated with the domain, implying that HTTPS connections are not available. DNS resolution points to IP address 188.114.96.3, which is attributed to AS13335 Cloudflare, Inc. and geolocated to the United States.

The page title reported by crawlers is "Blockchain Dapps," which aligns with the declared scam type of a "Fake Airdrop" and the broader threat classification of a crypto drainer. VirusTotal scans have returned seven positive detections out of ninety‑three scanners, confirming that multiple security vendors consider the domain malicious. The domain is also listed by PhishDestroy, confirming its presence on an active blocklist. The observable evidence establishes a clear malicious profile: recent creation, lack of encryption, Cloudflare‑hosted infrastructure, and multiple vendor detections.

However, the offline status prevents direct inspection of the payload, and the limited blocklist presence (only one blocklist) leaves uncertainty around the full scope of active campaigns. Defenders should continue to block the domain at network perimeter, add the IP address 188.114.96.3 to deny lists, and monitor for any future re‑registration of similar subdomains under the pages.dev namespace. Regular re‑scanning of the domain on VirusTotal and inclusion in threat‑intelligence feeds are recommended to capture any changes in detection status. Organizations that previously allowed traffic to pages.dev should verify that no residual connections remain, and incident response teams should treat any related crypto‑drainer activity as high‑risk, given the elevated risk rating.