isthatblep-airdrop[.]pages[.]dev

This domain, isthatblep-airdrop.pages.dev, is under active investigation for hosting a crypto drainer operation. Analysis indicates it is flagged by two security blocklists and has been specifically blocked by PhishDestroy and ScamSniffer, both of which specialize in cryptocurrency-related fraud detection. The domain resolves to IP address 172.66.44.161, which is associated with Cloudflare’s infrastructure, a common hosting choice for both legitimate and malicious sites due to its proxy and DDoS protection services. No autonomous system number (ASN) or geolocation data is currently available for this IP, limiting attribution to a specific provider or region.

VirusTotal scans conducted by 91 vendors show no detections at present, though this absence does not confirm the domain’s safety. The lack of detections may reflect the domain’s recent activation, evasion techniques, or delayed vendor updates. No additional context is available regarding the domain’s registration details, SSL certificate, HTTP response codes, or page content, as these have not been provided in the available intelligence. The exact nature of the crypto drainer—such as whether it targets specific wallets, blockchains, or employs social engineering—remains unconfirmed due to the absence of page-level analysis.

Defenders should treat this domain as high-risk for cryptocurrency fraud until further evidence is gathered. Network-level blocking is recommended based on the existing blocklist entries and vendor detections. Organizations should monitor for connections to 172.66.44.161 in logs and consider flagging the domain in endpoint protection and web filtering systems. Further investigation is required to determine the scope of the threat, including any associated wallet addresses, transaction patterns, or additional infrastructure linked to this operation.