twa-airdrop04[.]pages[.]dev

This domain, twa-airdrop04.pages.dev, is under investigation for hosting an airdrop scam designed to impersonate legitimate cryptocurrency token distributions. Analysis indicates the site targets users seeking free token allocations, a common tactic to harvest wallet credentials or distribute malicious payloads. The page title is set to "home," a generic but deliberate choice to avoid immediate suspicion while mimicking authentic airdrop portals. Infrastructure analysis reveals the domain was registered on June 09, 2026, through Cloudflare Pages, a platform frequently abused for rapid deployment of phishing sites. It currently resolves to the IP address 172.66.45.2 and holds a valid SSL certificate issued by Google Trust Services (WE1). Despite its active status, the domain has not yet been widely flagged, with VirusTotal reporting 0/95 detections. However, it appears on one security blocklist, suggesting early-stage detection by at least one threat intelligence feed. Users who have interacted with this domain should immediately revoke any wallet permissions granted and monitor connected accounts for unauthorized transactions. If credentials or private keys were entered, affected wallets should be considered compromised, and funds transferred to a new secure wallet. Browser-based extensions or applications downloaded from the site should be removed, and systems scanned for malware. Given the domain’s recent creation and low detection rate, heightened vigilance is advised for similar airdrop-themed lures.