claim-lobstar[.]pages[.]dev

The domain claim-lobstar.pages.dev is actively engaged in brand impersonation, specifically targeting Twitter users with a fraudulent airdrop scheme. Analysis indicates this is not a generic phishing attempt but a calculated effort to deceive users into believing they are interacting with an official Twitter promotion. The site is currently operational and has not been taken down despite multiple security flags. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Cloudflare, Inc., a registrar frequently utilized for its privacy and proxy services. It resolves to the IP address 172.66.44.164, located within Cloudflare’s US-based autonomous system (AS13335). The domain is flagged by 5 of 95 security vendors on VirusTotal, a notably high detection rate for a recently created domain. Additionally, it appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, further corroborating its malicious intent. The SSL certificate, issued by Let’s Encrypt, is valid but provides no inherent trust, as it is commonly used by both legitimate and malicious sites. Current evidence confirms the domain remains active and continues to pose a significant risk to users. The combination of brand impersonation, airdrop-themed deception, and technical indicators such as the Cloudflare-hosted infrastructure and blocklist presence elevates the threat level to high. Users are strongly advised to avoid interacting with this domain, as it likely aims to harvest credentials or deploy crypto-draining malware. Network administrators should implement blocking measures at the DNS or firewall level, and security teams should monitor for related indicators of compromise, including the associated IP address and SSL certificate thumbprint.