claimesa[.]pages[.]dev

This domain, claimesa.pages.dev, is actively impersonating a legitimate cryptocurrency airdrop portal to deceive users into connecting their wallets. The site poses as a platform distributing free tokens, a common tactic used in crypto drainer schemes. Victims who interact with the site risk unauthorized transactions, leading to the theft of digital assets stored in connected wallets. The page title, 'Airdrop Portal | Masa,' suggests an attempt to mimic trusted projects or platforms, increasing the likelihood of user engagement under false pretenses.

Analysis indicates this domain was registered on July 28, 2024, through Cloudflare, Inc., a provider frequently used to obscure malicious infrastructure. As of the latest scan, only 1 out of 95 security vendors on VirusTotal flagged the domain, highlighting its ability to evade detection. The site resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), which is consistent with threat actors leveraging content delivery networks to mask their operations. Additionally, the domain appears on 5 security blocklists, including those maintained by crypto-focused security entities, further confirming its malicious intent.

Users who have visited claimesa.pages.dev or interacted with its content should immediately disconnect any connected wallets from the site. Monitor wallet activity for unauthorized transactions and revoke any suspicious permissions granted to decentralized applications. If assets were transferred or compromised, report the incident to relevant blockchain explorers and consider filing a report with local cybercrime authorities. Avoid re-engaging with the domain or similar sites, and verify the legitimacy of airdrop offers through official project channels before taking any action.