claim-profit[.]pages[.]dev

This domain, claim-profit.pages.dev, is identified as a high-risk brand impersonation threat specifically targeting Twitter users. Analysis of the page title, 'Profit | Airdrop,' and associated infrastructure indicates an intent to deceive victims into engaging with fraudulent crypto airdrop schemes. The domain impersonates Twitter to exploit user trust, likely aiming to harvest credentials or deploy crypto drainer malware. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.101, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). Security vendor detections on VirusTotal stand at 3/95, while the domain appears on four distinct security blocklists. Notably, the domain is actively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. As of the latest assessment, claim-profit.pages.dev remains active and unmitigated, posing an ongoing risk to users. The domain's infrastructure, combined with its impersonation of a high-profile social media platform, suggests a persistent threat vector for credential theft or crypto asset compromise. Users are advised to avoid interaction with the domain, and security teams should prioritize blocking the domain and its associated IP address (172.66.47.101) at the network level. Continuous monitoring for related domains or subdomains is recommended to mitigate further exposure.