flare-airdrop[.]pages[.]dev

The domain flare-airdrop.pages.dev is a cryptocurrency phishing site designed to deploy a crypto drainer, a type of malware that siphons digital assets from victims' wallets. No legitimate brand or drainer kit was identified in association with this domain. As of the latest verification, flare-airdrop.pages.dev has been taken offline, but it previously posed an elevated risk to users who may have interacted with it.

Technical indicators confirm the malicious nature of flare-airdrop.pages.dev. The domain was flagged by 1 of 95 VirusTotal security vendors, including Trustwave, and was listed on Google Safe Browsing for 'SOCIAL_ENGINEERING' phishing. It appeared on 1 security blocklist (PhishDestroy) and was registered through Cloudflare, Inc. on September 04, 2025. The domain resolved to the IP address 172.66.44.215, hosted by Cloudflare in the US (AS13335), and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Suspected phishing site | Cloudflare', and the site returned an HTTP 403 status. Technologies detected included HSTS, Cloudflare, and HTTP/3, while Gridinsoft assigned it a trust score of 0/100.

Users who interacted with flare-airdrop.pages.dev should immediately revoke any token approvals granted to unknown or suspicious contracts using a tool like Etherscan or Revoke.cash. Funds should be transferred to a new, secure wallet to prevent further unauthorized access. Additionally, victims are advised to report the domain to their wallet provider, local cybercrime authorities, and platforms like Google Safe Browsing or PhishTank to aid in broader mitigation efforts.