slurmitclaim[.]pages[.]dev

The domain slurmitclaim.pages.dev poses a brand impersonation threat by masquerading as an official Twitter airdrop campaign. The page title, "Slurmit | Airdrop," attempts to trick users into believing they can claim a cryptocurrency airdrop associated with Twitter, a common social engineering tactic. In reality, this site is designed to steal credentials or personal information from unsuspecting visitors, leveraging the trust in the Twitter brand to lower defenses. The threat is classified as high risk due to its active status and clear impersonation of a major social media platform.

Technical analysis reveals several red flags. VirusTotal reports that 1 out of 95 security vendors flag this domain as malicious, indicating some detection but not widespread awareness. The domain was created on February 26, 2026, making it very recent, and is registered through Cloudflare, Inc., which often provides anonymity to malicious actors. It resolves to IP address 172.66.47.59 and uses a Let's Encrypt SSL certificate (E8), a common choice for low-cost SSL that does not verify legitimacy. Furthermore, it appears on 4 security blocklists, reinforcing its suspicious nature.

Users who have visited slurmitclaim.pages.dev should immediately change any passwords entered on the site and enable two-factor authentication on their Twitter and email accounts. They should also monitor for unusual account activity and consider running a security scan on their device. As a precaution, avoid clicking links in unsolicited messages about airdrops, and always verify official campaigns through Twitter's verified channels. PhishDestroy recommends blocking this domain at the network level and reporting it to relevant security teams.