claim-elon[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting cryptocurrency users through a fraudulent airdrop scheme. The site, titled 'Elon Coin | Airdrop,' mimics legitimate token distribution events to deceive victims into connecting wallets or disclosing private keys, enabling unauthorized asset transfers. Analysis indicates the domain is designed to exploit interest in Elon Musk-associated crypto projects, a common tactic in recent drainer campaigns. Infrastructure analysis reveals the domain claim-elon.pages.dev was registered on January 30, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.105 (AS13335, Cloudflare, Inc., US). It is currently active and secured with a Google Trust Services SSL certificate (WE1). The domain appears on four security blocklists and is blocked by multiple detection engines, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, with detections likely tied to its association with known crypto drainer infrastructure. Mitigation requires immediate blocking of the domain and its resolving IP at network and endpoint levels. Users should be warned against interacting with unsolicited airdrop promotions, particularly those leveraging high-profile brand names. Wallet security best practices include verifying domain authenticity via official project channels, using browser-based wallet extensions with built-in scam detection, and isolating airdrop interactions to dedicated wallets with minimal funds. Organizations should update phishing awareness training to include crypto-specific threats, emphasizing the risks of wallet connection requests on unverified sites. Monitoring for related domains using the 'elon' or 'airdrop' keywords is recommended to preempt similar campaigns.