claim-ordinals[.]pages[.]dev

This domain is flagged as a high-risk credential phishing site specifically impersonating Twitter (now X) to harvest user login credentials. Analysis indicates the site employs brand impersonation tactics, presenting a fraudulent interface labeled 'Dog Runestone Snapshot' to deceive victims into entering sensitive account information. The threat is categorized as active and sophisticated, given its targeted approach and use of legitimate-looking infrastructure. Infrastructure analysis reveals the domain claim-ordinals.pages.dev was registered through Cloudflare, Inc. on April 22, 2024, and currently resolves to the IP address 172.66.46.240, hosted on Cloudflare's network (AS13335) in the United States. Despite its recent creation and active malicious operations, the domain has not yet been flagged by antivirus engines, with a VirusTotal detection score of 0/95. The SSL certificate is issued by Google Trust Services (WE1), adding a layer of apparent legitimacy. The domain appears on three security blocklists, including PhishDestroy, ScamSniffer, and Enkrypt, which have already classified it as malicious. Mitigation against this threat requires immediate action from security teams and end users. Network administrators should block the domain claim-ordinals.pages.dev and its resolving IP 172.66.46.240 at the firewall or DNS level to prevent access. Users should be educated to recognize impersonation tactics, particularly those involving fake login portals or too-good-to-be-true offers related to cryptocurrency or social media rewards. Multi-factor authentication (MFA) should be enforced for all social media accounts to mitigate the impact of credential theft. Security teams are advised to monitor for any indicators of compromise, such as unusual login attempts or unauthorized access, and to report the domain to additional threat intelligence platforms to improve detection coverage.