x-distribution-checker[.]pages[.]dev

This domain, x-distribution-checker.pages.dev, is flagged as a high-risk brand impersonation threat targeting cryptocurrency users through a fraudulent airdrop scheme. Analysis indicates the page title explicitly displays 'XRPFi Airdrop,' suggesting an attempt to deceive victims into believing they are interacting with a legitimate XRPFi distribution event. The infrastructure is designed to harvest credentials or private keys under the guise of an airdrop verification process, a common tactic in cryptocurrency drainer operations. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on May 13, 2026, and currently resolves to the IP address 172.66.47.133, located in California and associated with Cloudflare's network. Despite its active status, the domain has not been flagged by VirusTotal, showing 0 detections out of 95 security engines. However, it appears on three independent security blocklists and is actively blocked by multiple threat intelligence feeds. The SSL certificate is issued by Let's Encrypt, providing a superficial layer of legitimacy while the underlying content remains malicious. As of the latest assessment, x-distribution-checker.pages.dev remains active and poses a significant risk to users unaware of cryptocurrency scams. While several security providers have implemented blocks, the domain's low detection rate on aggregate scanning platforms suggests it may still evade some automated defenses. Users are advised to treat any interaction with this domain as fraudulent, particularly any prompts to connect wallets or disclose recovery phrases. The continued operation of this domain underscores the need for real-time threat intelligence and cautious verification of airdrop claims before engagement.