river-dmt[.]pages[.]dev

This domain, river-dmt.pages.dev, is currently under investigation for brand impersonation targeting users through an airdrop scam. The site specifically mimics River Protocol, presenting itself as "River Pts S4 Airdrop" to deceive visitors into engaging with fraudulent cryptocurrency distribution schemes. Analysis indicates the domain is designed to exploit trust in legitimate airdrop campaigns, potentially leading to financial loss or credential theft. Infrastructure analysis reveals the domain was registered on June 10, 2026, through Cloudflare Pages, a platform often leveraged for rapid deployment of malicious sites. It resolves to the IP address 188.114.97.3 and employs an SSL certificate issued by Google Trust Services (WE1), which may lend an appearance of legitimacy. Despite its active status, the domain has been flagged by two security blocklists, including PhishDestroy and ScamSniffer. Notably, VirusTotal reports 0 detections out of 95 vendors, suggesting the threat may still be evading widespread detection or is newly deployed. As of the latest assessment, river-dmt.pages.dev remains active and poses an ongoing risk to users. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include its IP address and SSL certificate thumbprint. Users should be educated to recognize airdrop scams, particularly those impersonating established protocols, and verify all promotional offers through official channels before engagement. Continuous monitoring of related infrastructure is recommended to identify potential pivot domains or secondary attack vectors.