claimuselesscoin[.]pages[.]dev

The domain claimuselesscoin.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 104.21.112.1, which is assigned to AS13335 in the United States. The site served over HTTPS with a Google Trust Services / WE1 certificate and advertised HSTS, Cloudflare, and HTTP/3 support. An HTTP request returned a 403 status, indicating the content is presently inaccessible; the infrastructure is marked offline. The page title returned by the server reads "Useless Coin - The Most Honest Cryptocurrency | $USELESS Token," suggesting a fake cryptocurrency airdrop narrative.

The operation explicitly impersonates CoinMarketCap, as indicated by the brand‑target field, and is classified as a "Fake Airdrop" scam. VirusTotal analysis recorded a single detection out of 93 scanning engines, and the domain appears on one external blocklist. PhishDestroy has also listed the domain as blocked, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. Nameservers are javier.ns.cloudflare.com and shaz.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service.

No further technical artefacts such as malware payloads or credential‑stealing forms have been observed, and the exact phishing page content remains unverified due to the 403 response. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation of the IP address, and update threat‑intel feeds with the observed indicators of compromise, including the IP, certificate fingerprint, and nameserver details. Ongoing surveillance is advised to detect potential redeployment of the same infrastructure for future fraudulent campaigns.