claim-mushu[.]pages[.]dev

Analysis indicates that claim-mushu.pages.dev presents a high-risk brand impersonation threat. The observed page title, "MUSHU | Airdrop," suggests the use of promotional lures commonly associated with credential theft, account takeover attempts, or fraudulent authorization workflows. By imitating the appearance or trust signals of a recognized online platform, the domain may encourage users to disclose sensitive information or approve malicious actions. The domain remains active and should be considered a current threat.

Infrastructure analysis reveals that the domain resolves to IP address 188.114.96.3, located in the US under AS13335 Cloudflare, Inc. Registration records indicate creation on February 21, 2026, through Cloudflare, Inc. Certificate inspection shows a Google Trust Services / WE1 TLS certificate. Security telemetry reports 2/95 detections from VirusTotal. The domain appears on 4 security blocklists and has been blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. These indicators collectively increase confidence that the infrastructure is associated with deceptive activity despite the relatively low vendor detection count.

Users should avoid connecting accounts, entering credentials, authorizing applications, signing transactions, or submitting personal information through this domain. Any user who interacted with the site should review account security settings, revoke unauthorized permissions, rotate exposed credentials, and monitor for suspicious activity. Organizations may benefit from blocking connections to 188.114.96.3, monitoring network logs for related traffic, and educating users about brand impersonation techniques that leverage promotional themes and counterfeit trust indicators.