scallop-airdrop[.]pages[.]dev

The domain scallop-airdrop.pages.dev was created on March 03, 2026 and is registered through Cloudflare, Inc. It resolves to the IP address 172.66.46.221, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a page title of "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that the content is currently inaccessible. The SSL certificate is issued by Google Trust Services under the WE1 identifier, and the service is protected by HSTS, Cloudflare edge caching, and HTTP/3. Reputation data shows a Gridinsoft trust score of 0 out of 100.

VirusTotal analysis records six detections out of ninety‑four security vendors, and the domain appears on three external blocklists. It has also been blocked by PhishDestroy, MetaMask, and SEAL. The infrastructure details, including the Cloudflare nameservers bart.ns.cloudflare.com and jamie.ns.cloudflare.com, suggest the operators leveraged a legitimate hosting provider to gain credibility. The listed scam type is a "Fake Airdrop," indicating an attempt to lure cryptocurrency users into disclosing private keys or transferring assets under the pretense of a token distribution.

No additional payload or page content has been captured, leaving the exact phishing flow uncertain. Defenders should continue to block the domain and its associated IP address at perimeter controls, ensure that endpoint protection solutions incorporate the six VirusTotal detections, and propagate the three blocklist entries across DNS filtering services. Monitoring for newly registered subdomains under the pages.dev namespace that reference airdrop themes is recommended, as the threat actor may recycle similar tactics. Given the low trust score and multiple blocklist entries, the domain should be treated as high confidence malicious and included in incident response playbooks for crypto‑related social engineering campaigns.