claimponke[.]pages[.]dev

This domain, claimponke.pages.dev, is actively engaged in brand impersonation targeting cryptocurrency users through an airdrop scam. The site falsely presents itself as an official Ponke token distribution platform, luring victims with promises of free tokens. Current status confirms the domain remains operational and accessible as of the latest verification. Analysis reveals the domain has been flagged by 9 of 95 security vendors on VirusTotal, indicating a high-confidence malicious classification. Infrastructure analysis shows the domain was registered on August 17, 2024, through Cloudflare, Inc., and resolves to the IP address 172.66.46.253, hosted on Cloudflare’s US-based AS13335 network. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors leveraging legitimate CDN providers. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, further corroborating its fraudulent nature. The operational status of claimponke.pages.dev presents an ongoing risk to users seeking legitimate cryptocurrency airdrops. Organizations and individuals are advised to implement immediate network-level blocking of the domain and its associated IP address. Security teams should update detection rules to include this domain in phishing and brand impersonation filters. End-users should be educated on verifying official airdrop announcements through trusted channels and avoiding interactions with unsolicited token distribution links. Monitoring for similar domains using the same registrar or hosting provider may help identify related threat campaigns.