orbitervalidator[.]pages[.]dev

On July 24, 2026 analysts observed that the domain orbitervalidator.pages.dev is operating a high‑risk fake‑airdrop campaign that impersonates CoinMarketCap. The site was registered on February 21, 2026 through Cloudflare, Inc., and its DNS resolves to 188.114.96.3, an IP address owned by AS13335 Cloudflare in the United States. The domain serves content over HTTPS using a Google Trust Services / WE1 certificate and enforces HTTP Strict Transport Security. An HTTP request to the origin returns a 403 status, suggesting the page is no longer publicly reachable; the current status is recorded as taken offline.

Page metadata reveals the title "Blockchain Rectification," which aligns with the reported scam type of a fake airdrop. Google Safe Browsing flags the domain for social engineering, and VirusTotal records 11 of 95 scanning engines flagging the host as malicious. Third‑party security services—including Gridinsoft (trust score 0/100), PhishDestroy, Polkadot, Enkrypt, and Codeesura—have placed the domain on blocklists, and it appears on four additional security blocklists. Nameservers are charles.ns.cloudflare.com and heather.ns.cloudflare.com, confirming Cloudflare’s hosting role.

While the exact phishing page content has not been captured, the convergence of brand impersonation, a fraudulent airdrop narrative, and multiple independent detections indicates a well‑crafted social‑engineering vector. Defenders should block the domain at network perimeters, update URL filtering and email security policies, and monitor for any resurgence of the infrastructure. Continuous observation of the associated IP and Cloudflare nameservers is advised to detect potential re‑hosting of similar campaigns.