io-etherfi[.]pages[.]dev

Analysis indicates that the domain io-etherfi.pages.dev is actively hosting a fake airdrop page titled “ether.fi Airdrop » Claim ETHFI tokens”. The site was registered on June 13 2026 through Cloudflare, Inc. and resolves to the Cloudflare IP address 172.66.47.197, which is associated with the Cloudflare network in Canada. DNS resolution uses the Cloudflare authoritative nameservers faye.ns.cloudflare.com and reese.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of standard HTTPS. The page incorporates third‑party services such as theTradeDesk, Statcounter, Microsoft Advertising, Google Tag Manager, Google Analytics, Facebook Pixel, and the crypto‑js library, suggesting tracking and possible credential harvesting. The site matches the known “Airdrop Scam” phishing kit and appears on a single security blocklist; it has been blocked by PhishDestroy and receives a Gridinsoft trust score of 0 / 100. VirusTotal reports a single vendor detection out of 91, indicating limited but existent malicious labeling. The HTTP response code is 200, confirming the page is reachable. Uncertainty remains regarding the exact payload delivered to visitors and whether additional command‑and‑control infrastructure is employed, as no malware samples or post‑execution behavior have been observed. Defenders should add the domain and its resolving IP to blocklists, enforce DNS filtering for the .dev TLD, monitor outbound connections to the listed third‑party services for anomalous activity, and update intrusion‑detection signatures to flag the “ether.fi Airdrop” page title. Continuous re‑assessment is advised to capture any evolution of the campaign.