velar-airdrop[.]pages[.]dev

This domain, velar-airdrop.pages.dev, is currently active and hosts a page titled “Velar”. The site was registered on May 01 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑provided IP address 172.66.46.253, which is geolocated to Canada. DNS resolution uses the Cloudflare nameservers bart.ns.cloudflare.com and raphaela.ns.cloudflare.com. HTTPS is delivered by a Google Trust Services / WE1 certificate and the server responds with HTTP 200 over HTTP/3, indicating modern protocol support. The page loads third‑party libraries including Unpkg, SweetAlert2, jsDeliri, crypto‑js, and cdnjs, and the response includes HSTS headers. Intelligence flags the site as a “Fake Airdrop” crypto‑drainer campaign. It is listed on three external blocklists and has been flagged by Google Safe Browsing for social engineering. Reputation services assign a Gridinsoft score of 0/100 and a Scamadviser score of 1/100, reflecting extreme distrust. The domain appears on blocklists PhishDestroy, ScamSniffer, and Enkrypt. VirusTotal records indicate the URL was scanned by 91 vendors with no detections, but the absence of a detection does not confirm safety. At present, no additional payload or credential‑harvesting behavior has been captured beyond the observed page title and included libraries. Defenders should treat the domain as high‑risk, block DNS resolution and HTTP traffic to the host, and add the indicator to URL filtering rules. Continuous monitoring for changes to the page content or new malicious payloads is recommended.