claimjindoncoinairdropportal[.]pages[.]dev

The domain claimjindoncoinairdropportal.pages.dev was observed hosting a fake cryptocurrency airdrop page titled “Multiverse Deep Sync – One wallet, multiverse support”. The site was created on 21 February 2026 and immediately provisioned through Cloudflare, Inc., using Cloudflare’s DNS service (annabel.ns.cloudflare.com, kipp.ns.cloudflare.com). DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the “WE1” label, indicating a valid HTTPS endpoint, while the HTTP response returned a 403 status code, suggesting the page is currently inaccessible or deliberately blocked.

Multiple security engines have flagged the domain. VirusTotal recorded 14 detections out of 93 scanners, and Google Safe Browsing categorised the site as “social engineering”. Independent blocklist providers such as PhishDestroy have listed the domain, and Gridinsoft assigned a trust score of 0 / 100, reflecting a high confidence of malicious intent. The overall threat classification supplied is “Fake Airdrop”, consistent with a crypto‑drainer campaign that seeks to harvest private keys or wallet credentials.

Infrastructure analysis shows the use of HSTS, Cloudflare’s HTTP/3 support, and the standard Cloudflare CDN, a pattern commonly adopted by threat actors to obscure the true hosting location and to leverage the provider’s reputation for evasion. The combination of a newly registered domain, a legitimate‑looking SSL certificate, and the presence on multiple threat intelligence feeds provides strong evidence that the site was created expressly for fraudulent cryptocurrency collection.

Uncertainty remains regarding the exact payload delivered to victims, as the page content has not been captured and the site currently returns a 403 response.