gritdistribution[.]pages[.]dev

Analysis indicates that gritdistribution.pages.dev is currently active and was registered on April 27, 2026. The domain resolves to 172.66.47.24, an IP owned by Cloudflare, Inc. in Canada, and is served behind Cloudflare’s CDN with HSTS enabled. TLS termination is provided by Google Trust Services under the WE1 certificate. The site loads external libraries from Tailwind CSS, Unpkg, SweetAlert2, jsDelivr, crypto‑js, and cdnjs, confirming a typical front‑end stack used by many phishing kits. The page title “GRIT | Airdrop” and the classification “Fake Airdrop” align with the known Airdrop Scam kit, indicating an attempt to lure victims with a fraudulent token distribution. Reputation services assign a Scamadviser score of 11/100 and a Gridinsoft score of 0/100, reflecting a high likelihood of malicious intent. The domain is listed on three security blocklists and is blocked by PhishDestroy, ScamSniffer, and Enkrypt. VirusTotal reports detections from 11 of 91 scanning engines, providing additional corroboration of malicious activity. Defenders should immediately block the domain at perimeter and DNS layers, monitor for DNS queries to the associated Cloudflare IP, and add the domain to internal threat intel feeds. Continuous observation is advised, as the exact content beyond the title has not been publicly disclosed, and further payloads may be delivered through the referenced JavaScript libraries.