reward-welikethefoxcom[.]pages[.]dev

This domain, reward-welikethefoxcom.pages.dev, is actively flagged as a high-risk phishing site impersonating Layer3, a known blockchain or Web3 platform, based on the page title 'W3: Foxy - Layer3'. Infrastructure analysis reveals the domain is hosted on Cloudflare Pages (188.114.97.3) and registered through Cloudflare, Inc., with nameservers brenda.ns.cloudflare.com and carl.ns.cloudflare.com. The domain was created on October 26, 2024, and remains operational as of July 12, 2026, returning an HTTP 200 status. The SSL certificate is issued by Google Trust Services (WE1), and the IP geolocates to Canada under Cloudflare's network. The site is classified as a fake airdrop scam, a common tactic targeting cryptocurrency users by promising free tokens or rewards in exchange for sensitive information or wallet connections. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating confirmed malicious activity. While 91 vendors scanned the domain via VirusTotal, none currently flag it, though this absence does not confirm safety. The exact content and mechanics of the scam are not yet analyzed, but the combination of a Layer3-themed title, Cloudflare hosting, and blocklist presence strongly suggests an active credential or wallet-draining operation. Defenders should treat this domain as malicious and implement blocking at the DNS or network level. Users should be warned against interacting with the site, particularly those engaged in Web3 or cryptocurrency activities. Further investigation into connected infrastructure, such as associated wallets or redirect chains, is recommended to identify additional threat vectors.