borpatoken-claim[.]pages[.]dev

The domain borpatoken-claim.pages.dev was registered on March 28, 2026 via Cloudflare and resolves to the Cloudflare‑owned IP 172.66.46.225 located in CA. The site serves HTTP/3 traffic, enforces HSTS, and presents a Google Trust Services / WE1 SSL certificate, indicating a correctly configured TLS endpoint but not a trustworthy service. The page title "BorpaToken - The Next Generation Memecoin" and the classified scam type "Fake Airdrop" align with a crypto‑drainer campaign that lures victims with promises of free tokens and then attempts to extract cryptocurrency assets. Reputation services assign a Scamadviser score of 11/100 and a Gridinsoft score of 0/100, and the domain appears on three independent blocklists (PhishDestroy, ScamSniffer, Enkrypt). No malware detections are reported by the 94 VirusTotal scanners, but the absence of detections does not imply safety. Current evidence is limited to infrastructure and reputation data; the actual page content has not been examined, leaving the exact phishing flow unverified. Defenders should proactively block the domain and its associated IP at perimeter and DNS layers, flag any email or messaging that references BorpaToken airdrops, and monitor for similar Cloudflare‑hosted domains that employ HSTS and HTTP/3 while presenting low trust scores. Continuous observation of new registrations using the same nameservers (chris.ns.cloudflare.com, gracie.ns.cloudflare.com) is recommended to intercept emerging crypto‑drainer infrastructure.