ponkerevairdrop[.]pages[.]dev

This domain, ponkerevairdrop.pages.dev, is flagged as a high-risk brand impersonation campaign targeting cryptocurrency users through a fraudulent airdrop scheme. Analysis of the page title, "Join the Ponke Airdrop and Get your tokens!", confirms the intent to deceive victims into believing they are interacting with a legitimate Ponke token distribution event. The threat type is classified as brand impersonation with a cryptocurrency drainer component, designed to trick users into connecting wallets or disclosing private keys, leading to unauthorized asset transfers. Infrastructure analysis reveals the domain resolves to the IP address 172.66.45.35, geolocated to Cloudflare, Inc. in Canada. The domain is registered through Cloudflare, Inc., with a creation date of April 01, 2026, indicating recent deployment. Detection metrics show minimal coverage, with only 1 of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on a single security blocklist, suggesting limited visibility or evasion of broader detection mechanisms. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted domains. As of the latest assessment, ponkerevairdrop.pages.dev remains active and unmitigated, posing a continued risk to cryptocurrency users. The domain has been blocked by at least one security provider, but the lack of widespread detection increases the likelihood of successful victimization. Users are advised to verify airdrop legitimacy through official project channels and avoid interacting with unsolicited token distribution links. Organizations should update blocklists to include this domain and monitor for related infrastructure, such as additional subdomains or IP associations, to prevent further exploitation.