airdrop-ui[.]pages[.]dev

PhishDestroy identifies airdroputil.pages.dev as an active brand impersonation scam mimicking Airdrop Scam to deceive users into connecting cryptocurrency wallets and surrendering private keys or seed phrases. This fraudulent domain is hosted on Cloudflare IP 172.66.44.211 under the Cloudflare, Inc. registrar and leverages Google Trust Services SSL certificates to appear legitimate. While currently undetected by security engines, the site remains under active investigation and should be treated as a high-risk threat until proven otherwise. This domain exhibits minimal footprint in detection systems, with 0 out of 95 VirusTotal engines flagging it at the time of analysis. It resolves to the Cloudflare IP 172.66.44.211 and is registered through Cloudflare, Inc., a common provider for malicious actors seeking anonymity and rapid deployment. The use of a Google Trust Services SSL certificate further enhances its deceptive credibility. Such tactics are consistent with recent brand impersonation campaigns targeting cryptocurrency users, where threat actors replicate official branding to harvest sensitive wallet data. Users who visited airdroputil.pages.dev should immediately disconnect any connected wallets, revoke any approved permissions, and transfer assets to a secure, offline wallet. Avoid entering any private keys, seed phrases, or wallet credentials on this site. Report the domain to your security provider and relevant blocklists. Use caution with domains hosted on Cloudflare that impersonate legitimate services, especially those associated with cryptocurrency airdrops or wallet connections. Always verify URLs through official channels and consider using browser-based phishing protection tools.