check-base-airdrop-eligibility[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Base cryptocurrency users. Analysis indicates the site mimics legitimate airdrop eligibility checks, a common vector for credential harvesting and wallet-draining attacks. The page title, 'Check Base Airdrop Eligibility — Who Qualifies?', directly exploits user interest in token distributions, increasing the likelihood of successful social engineering. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on March 28, 2026, and resolves to IP address 172.66.47.138, hosted by Cloudflare in California. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often abused by malicious actors. VirusTotal detection shows 6 out of 95 security vendors flag the domain as malicious, while PhishDestroy has already blocked it. The domain appears on one security blocklist, and its Cloudflare-hosted infrastructure aligns with patterns observed in other high-risk impersonation campaigns. Mitigation requires immediate blocking of the domain (check-base-airdrop-eligibility.pages.dev) and its resolving IP (172.66.47.138) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) to endpoint detection systems and monitor for connections to the domain or IP. User awareness training should emphasize the risks of airdrop-themed phishing, particularly those hosted on content delivery networks or cloud platforms. Cryptocurrency wallet interactions with this domain should be treated as compromised, necessitating revocation of permissions and transfer of assets to new wallets.