lobstar-airdrop[.]pages[.]dev

This domain, lobstar-airdrop.pages.dev, is flagged for brand impersonation targeting cryptocurrency users through an airdrop scam. The page title, "Lobstar — Airdrop 🦞," directly mimics legitimate airdrop promotions to deceive victims into interacting with malicious smart contracts or wallet-draining scripts. No specific drainer kit has been attributed to this domain yet, but the infrastructure aligns with common airdrop fraud tactics, including the use of emoji-laden titles to appear legitimate and urgency-driven calls to action.

Infrastructure analysis reveals the domain was registered on February 24, 2026, via Cloudflare Pages, a platform frequently abused for rapid deployment of phishing sites. It resolves to the IP address 172.66.47.202, a Cloudflare-hosted endpoint with no prior malicious associations in public threat feeds. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites. VirusTotal reports 0 detections out of 95 engines, indicating low initial visibility, while one security blocklist has flagged the domain. No entries were found in Google Safe Browsing or other major reputation services at the time of analysis.

The domain remains active, with no takedown requests or sinkholing observed. Response actions should include monitoring for changes in detection status, particularly on VirusTotal or other aggregated threat feeds, as well as tracking associated IP addresses for additional malicious domains. Users are advised to verify airdrop promotions exclusively through official project channels and to inspect domain registration dates, SSL certificates, and hosting providers for anomalies. Wallet interactions with this domain should be treated as high-risk, and any connected transactions should be reviewed for unauthorized token approvals or fund transfers.