nesa-airdrop[.]pages[.]dev

The domain nesa-airdrop.pages.dev has been identified as engaging in brand impersonation tactics, specifically targeting victims through an airdrop scam. There is no current evidence of a crypto drainer kit associated with this domain, but it mimics typical airdrop scam schemes designed to deceive users into compromising their assets or credentials.

From a technical perspective, nesa-airdrop.pages.dev resolves to the IP address 172.66.44.235 and uses an SSL certificate issued by Google Trust Services, which may lend it an appearance of legitimacy. The domain is registered via Cloudflare, Inc., a common registrar for many legitimate and malicious sites alike. VirusTotal analysis shows a clean sheet with 0 out of 95 engines flagging the domain, which indicates that it has not yet been widely detected as malicious by automated systems. Additional data such as creation date and Google Safe Browsing status were not provided, but the domain currently appears active and unlisted on major blocklists.

Currently, nesa-airdrop.pages.dev remains active and under investigation with its risk level noted as under_investigation. Due to the lack of detections on VirusTotal so far, the domain could evade some conventional defenses and potentially target unsuspecting users. Analysts recommend heightened vigilance when interacting with domains mimicking airdrop services and advise users to verify any suspicious URL on trusted resources like PhishDestroy before engagement. Monitoring for emerging indicators and timely user education are essential steps to mitigate potential impact from this ongoing threat.