mantra-airdrop-check-guide[.]pages[.]dev

This domain operates as a brand impersonation scheme targeting cryptocurrency users through a fraudulent airdrop eligibility check. The page mimics legitimate Mantra token distribution events, presenting users with a fabricated "Mantra Airdrop — Check Your Eligibility Now" interface. Analysis indicates the site likely harvests wallet credentials or deploys crypto drainer scripts upon interaction, a common tactic in recent airdrop scam campaigns. The threat specifically exploits users' FOMO (fear of missing out) on token distributions, which has been observed in multiple incidents involving fake Layer 1 blockchain promotions. Infrastructure analysis reveals the domain was registered on June 13, 2025, through Cloudflare, Inc. and currently resolves to IP 172.66.47.126 (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often abused in phishing operations. Detection metrics show 0/95 engines flagging the domain on VirusTotal, while exactly one security blocklist (PhishDestroy) has identified the threat. The domain remains active as of investigation, with no takedown requests processed through the registrar or hosting provider. Users who visited mantra-airdrop-check-guide.pages.dev should immediately revoke any wallet permissions granted through the site. If credentials or private keys were entered, affected wallets must be considered compromised and funds transferred to new addresses. Browser data should be cleared to remove any stored session tokens or tracking scripts. Network administrators are advised to block the domain and its resolving IP (172.66.47.126) at the perimeter level. Given the 0/95 VirusTotal detection rate, this domain exemplifies the need for multi-layered detection beyond signature-based systems, particularly for emerging crypto threats.