gradient-airdrop-guide[.]pages[.]dev

The domain gradient-airdrop-guide.pages.dev is currently active and classified as a high-risk brand impersonation threat targeting cryptocurrency users. Analysis indicates it operates as a fake airdrop scam, specifically impersonating legitimate crypto reward programs to deceive victims into connecting wallets or sharing credentials. The page title, 'Gradient Airdrop — Earn EXP,' reinforces this deception by mimicking promotional campaigns for token distributions or yield opportunities.

Technical indicators confirm the malicious nature of this domain. It is flagged by 1 of 95 security vendors on VirusTotal, registered through Cloudflare, Inc. on June 13, 2025, and resolves to the IP address 172.66.44.171, hosted on Cloudflare’s network (AS13335) in the United States. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). Infrastructure analysis reveals the use of Cloudflare Pages, a common hosting service leveraged by threat actors to rapidly deploy and scale phishing campaigns while evading detection.

Current status remains active, posing an ongoing risk to users. Organizations and individuals are advised to block this domain at the network level, update endpoint protection rules to include its IP and SSL fingerprint, and alert users to the threat. Crypto wallet providers should flag interactions with this domain in transaction monitoring systems. Given the domain’s recent creation and low detection rate, continued monitoring for related infrastructure (e.g., subdomains, redirect chains) is recommended to preempt further abuse.