fhjvhbjkhvhjvhjv[.]pages[.]dev

Analysis indicates that the domain fhjvhbjkhvhjvhjv.pages.dev was registered through Cloudflare on 23 March 2026 and immediately pointed to the Cloudflare edge address 172.66.44.139, which resolves to a server located in Canada. The site served over HTTPS using a Google Trust Services / WE1 certificate and advertised modern protocols such as HSTS and HTTP/3. An HTTP 403 response was observed at the time of inspection, and the page title returned was “Arbitrum — Check your airdrop eligibility to govern Arbitrum,” matching a known fake‑airdrop phishing kit. The kit is explicitly labelled as an “Airdrop Scam” in the intelligence feed, and the domain is classified as a brand‑impersonation attempt targeting the Arbitrum ecosystem. VirusTotal scanned the host and recorded 2 detections out of 94 security vendors, confirming that at least two AV engines flagged the domain as malicious.

The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Independent scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent. Nameserver records point to asa.ns.cloudflare.com and zahir.ns.cloudflare.com, both owned by Cloudflare, confirming the registrar information. While the HTTP status code prevents direct content retrieval, the combination of the deceptive page title, the airdrop phishing kit, vendor detections, and blocklist presence provides strong evidence that the domain is being used to lure users into submitting wallet credentials or personal information under the pretense of an Arbitrum airdrop.

No further behavioral data, such as payload delivery or credential harvesting endpoints, has been observed, leaving the exact phishing workflow uncertain. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicator, and monitor for any related subdomains under the same Cloudflare account.