airdrop-ui-14u[.]pages[.]dev

PhishDestroy has identified airdrop-ui-14u.pages.dev as an active phishing domain engaged in brand impersonation, specifically targeting Discord users. The site presents itself as a "Neon Points Program" page, a lure designed to trick users into believing they are participating in a legitimate reward initiative. This is a classic social engineering tactic aimed at harvesting Discord credentials or other sensitive information. The threat is classified as high risk due to the active status and the popularity of the impersonated brand.

Technical analysis reveals that the domain resolves to IP address 188.114.97.3 and was created on April 9, 2025, through registrar Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), which may lend a false sense of legitimacy. VirusTotal data shows that 1 out of 95 security vendors flag this domain as malicious, indicating limited detection across the security community. Additionally, the domain appears on 1 security blocklist, underscoring its malicious nature. No Google Safe Browsing status is provided, but the low blocklist count suggests it may still be under the radar.

Currently, the domain remains active and accessible, posing an ongoing risk to users. PhishDestroy recommends that users avoid visiting the site, do not enter any personal or account information, and report the domain to Discord's abuse team. Organizations should update their email and web filters to block this domain. While the site has not yet been widely blacklisted, given its recent creation and high-risk impersonation of Discord, it is likely to be added to more blocklists soon. Users who may have interacted with the site should change their Discord passwords and enable two-factor authentication immediately.