airdrop-7su[.]pages[.]dev

This domain, airdrop-7su.pages.dev, is flagged as a brand impersonation threat targeting cryptocurrency users through a fraudulent airdrop scheme. The page title "Konnex" suggests an attempt to mimic legitimate crypto projects or wallets, likely to deceive users into connecting wallets or disclosing private keys. No specific drainer kit has been confirmed at this stage, but the infrastructure aligns with known airdrop scam patterns observed in recent campaigns. Analysis indicates the domain was registered on March 27, 2026, via Cloudflare Pages, a platform frequently abused for hosting malicious content due to its low-cost and anonymized deployment. It resolves to the IP address 172.66.47.167, geolocated to Cloudflare’s infrastructure in Canada. VirusTotal reports 0 detections out of 95 engines, indicating limited initial visibility, though it appears on two security blocklists: PhishDestroy and ScamSniffer. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious domains. The domain remains active as of the latest verification, with no takedown or sinkholing measures observed. Users are advised to block the domain and associated IP at the network level. Given the 0/95 detection rate on VirusTotal, organizations should prioritize monitoring for connections to this domain, particularly in environments where cryptocurrency-related activities occur. The absence of detections does not preclude malicious intent, and further investigation into wallet interactions or payload delivery is recommended.