site-1969384900-auroraproject-site[.]pages[.]dev

Analysis of site-1969384900-auroraproject-site.pages.dev shows an active generic phishing campaign delivering a fake cryptocurrency airdrop. The domain was registered on April 01 2026 through Cloudflare and resolves to 172.66.46.211, an IP owned by Cloudflare (AS13335) located in the United States. The site serves over HTTPS with a Let’s Encrypt certificate (YE2) and responds with HTTP 200, employing HSTS, HTTP/3, and Cloudflare’s edge services. The page title "$AURORA Token — Exclusive Airdrop" and the identified phishing kit (Airdrop Scam) match the observed scam type of a fake airdrop. VirusTotal records a single vendor detection out of 91 scans, and the domain appears on one public blocklist and is already blocked by PhishDestroy. The Gridinsoft trust score of 0/100 further confirms malicious intent. While the content of the landing page has not been examined directly, the convergence of registration data, hosting characteristics, title, kit attribution, and security‑vendor flags provides strong evidence that the domain is being used to harvest credentials or wallets under the guise of an airdrop. Defenders should block the domain at DNS and proxy layers, monitor for related indicator patterns (e.g., the IP 172.66.46.211 and the specific Cloudflare nameservers), and update detection rules to capture the "Airdrop Scam" kit signatures. Ongoing observation is recommended to detect any changes in hosting or content, but current evidence indicates a high‑risk, active phishing infrastructure.