airdropreward[.]pages[.]dev

This domain, airdropreward.pages.dev, was created on 21 February 2026 and is hosted on Cloudflare’s network (IP 172.66.46.248, AS13335, United States). The site presently returns an HTTP status indicating it has been taken offline; no TLS certificate is presented, and the only visible page title is “Suspected phishing site | Cloudflare”, which is a generic warning supplied by the CDN when a site is blocked. Registration information shows the domain was provisioned through Cloudflare, Inc., and the domain has been listed on a single security blocklist and actively blocked by the PhishDestroy feed.

VirusTotal records indicate that 93 scanning engines have examined the URL and reported no detections, though the absence of signatures does not constitute assurance of legitimacy. The intelligence tags the site as a “Fake Airdrop” campaign, falling under the broader “crypto drainer” threat category, suggesting attempts to lure victims into providing cryptocurrency wallet credentials or private keys under the pretense of an airdrop reward. Infrastructure analysis reveals no unique hosting patterns beyond the standard Cloudflare edge, and the lack of an SSL certificate further hampers confidence in the site’s authenticity.

Uncertainty remains regarding the exact payload or social‑engineering tactics employed, as the page content has not been captured. Defensive recommendations include adding airdropreward.pages.dev to domain‑based blocklists, enforcing DNS‑level denial for the FQDN, monitoring for any re‑hosting or IP change, and correlating logs for attempts to contact wallets or cryptocurrency services that reference the domain. Continuous observation of Cloudflare‑issued certificates and rapid response to future activation are advised to mitigate potential crypto‑drainer activity.