imptairdrop[.]pages[.]dev

PhishDestroy's threat intelligence system has identified an active brand impersonation domain targeting the cryptocurrency community. The domain imptairdrop.pages.dev is currently masquerading as a legitimate airdrop giveaway to deceive users into connecting cryptocurrency wallets or divulging sensitive information. The operation is under active investigation by the PhishDestroy analyst team, which is monitoring the domain for changes in infrastructure, content, or malicious payload delivery.

This domain was flagged by 1 out of 95 VirusTotal security vendors, indicating that mainstream antivirus or endpoint detection systems have not yet identified this specific campaign. The domain is registered through Cloudflare, Inc. and resolves to IP address 172.66.47.36. Cloudflare’s SSL certificate is issued by Google Trust Services, which may lend an initial air of legitimacy to the site despite its malicious intent. The domain is hosted on Cloudflare Pages, a legitimate platform often abused by threat actors to rapidly deploy and discard phishing pages. At the time of discovery, the domain exhibited no presence on major threat intelligence blocklists and maintained neutral trust scores from domain reputation services.

While the current detection rate remains low, the domain imptairdrop.pages.dev presents a clear and present risk to cryptocurrency users seeking airdrops. PhishDestroy recommends that users exercise extreme caution when encountering unsolicited airdrop links, especially those hosted on domains ending in .pages.dev or similar rapid-deployment services. Users should verify any airdrop campaign through official brand channels using pre-validated links or social media accounts. Additionally, cryptocurrency wallet users are advised to revoke any unintended approvals via blockchain explorers and monitor wallet transactions for suspicious activity. PhishDestroy continues to monitor this domain and has flagged it for inclusion in future threat intelligence feeds.