www-lunarclient-com[.]pages[.]dev

The domain www-lunarclient-com.pages.dev was registered on March 30, 2026 through Cloudflare, Inc. It resolves to the Cloudflare‑owned IP address 172.66.44.204, which is geolocated to Canada. The site returns HTTP 200 and presents the page title “The #1 Free Minecraft Client | Lunar Client”. Infrastructure analysis shows the domain is protected by Cloudflare, uses HSTS, HTTP/3, and includes Google Tag Manager and Google Analytics scripts. The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid TLS handshake. Intelligence classifies the activity as a “Fake Airdrop” generic phishing campaign targeting Minecraft users. The domain is currently listed on one security blocklist and has been blocked by PhishDestroy. A Gridinsoft trust score of 0 / 100 further indicates a malicious reputation. VirusTotal reports a single detection out of 94 scanned security vendors, corroborating the phishing classification. The domain remains active as of the report date. Defenders should add the domain and its resolved IP (172.66.44.204) to outbound and inbound deny lists, monitor DNS queries for the associated nameservers ethan.ns.cloudflare.com and margot.ns.cloudflare.com, and enforce web‑filtering policies that block access to content identified as a fake airdrop. Continuous re‑scanning is recommended to capture any changes in vendor detections or additional malicious payloads.