airdrop-3me[.]pages[.]dev

PhishDestroy identifies an active crypto drainer domain, airdrop-3me.pages.dev, abusively impersonating the Airdrop Scam brand to deceive users into connecting wallets and approving malicious token transfers. This fraudulent site leverages a Cloudflare Pages subdomain to host spoofed interfaces that closely mimic legitimate airdrop campaigns, tricking visitors into signing malicious transactions that drain cryptocurrency holdings. The threat actor utilizes a Google Trust Services SSL certificate to enhance credibility and operates on IP 188.114.96.3 to evade early detection.

This domain was flagged by PhishDestroy with zero VirusTotal detections (2/95 engines) as of latest scan, indicating minimal detection by security vendors. Registered through Cloudflare, Inc., the domain resolves to IP 188.114.96.3 and remains actively hosted on Cloudflare Pages. The campaign specifically targets users searching for airdrop opportunities and redirects them to malicious wallet interaction pages designed to extract private keys or approve unauthorized token transfers.

If you visited airdrop-3me.pages.dev, immediately revoke any connected wallet permissions using tools like revoke.cash or your wallet’s dApp browser. Do not approve unknown token approvals or transaction requests. Clear browser cache and disable suspicious browser extensions. Report the domain to your antivirus provider and block it via hosts file or network firewall. Educate others in your network to prevent further exposure to this crypto drainer campaign.