claim-bitcat[.]pages[.]dev

This domain, claim-bitcat.pages.dev, is flagged as an active brand impersonation threat targeting cryptocurrency users through an airdrop scam. Analysis indicates the site mimics the legitimate Bitcat platform, presenting a fraudulent airdrop offer designed to deceive victims into connecting digital wallets. The page title explicitly displays "Bitcat | Airdrop," reinforcing the social engineering lure. No specific drainer kit signatures have been confirmed at this time, though the infrastructure aligns with common wallet-draining phishing campaigns. Infrastructure analysis reveals the domain is hosted on Cloudflare’s content delivery network, resolving to IP address 172.66.44.133 (AS13335, United States). The domain is registered through Cloudflare, Inc., and uses an SSL certificate issued by Google Trust Services (WE1). Detection rates remain low, with only 1 of 95 security vendors on VirusTotal flagging the domain as malicious. However, the domain appears on three independent security blocklists, including feeds from cryptocurrency-focused threat intelligence sources. No Google Safe Browsing (GSB) detection has been recorded as of this report. The domain remains active and poses a high risk to users unfamiliar with phishing tactics in the cryptocurrency space. Recommended response actions include immediate blocking at the DNS and network levels, as well as wallet-level protections to prevent unauthorized transactions. Despite low detection rates, the domain’s presence on multiple blocklists and its active status warrant continued monitoring. Users are advised to verify airdrop legitimacy through official channels before interacting with any unsolicited offers.