lista-airdrops[.]pages[.]dev

Analysis of the domain lista-airdrops.pages.dev indicates elevated risk associated with crypto drainer activity, as confirmed by multiple security vendors and blocklists. As of July 29, 2026, five out of ninety-one security vendors on VirusTotal have flagged this domain, signaling detection of malicious behavior. The domain is actively blocked by PhishDestroy and ScamSniffer, two reputable threat intelligence platforms specializing in fraud and phishing prevention. Infrastructure analysis reveals the domain is hosted through Cloudflare, Inc., utilizing nameservers jessica.ns.cloudflare.com and ken.ns.cloudflare.com, and resolves to the IP address 188.114.97.3.

The domain appears on two independent security blocklists, further corroborating its association with malicious activity. The specific threat classification as a crypto drainer suggests the site may be designed to exploit cryptocurrency transactions, likely by tricking users into connecting wallets to malicious smart contracts that drain funds. While the exact content and mechanics of the site have not been fully analyzed, the combination of vendor detections, blocklist inclusions, and the domain's hosting on a Cloudflare Pages subdomain aligns with known patterns of crypto-related fraud.

Defenders should treat this domain as actively malicious and implement blocking measures at the network and endpoint levels. Organizations handling cryptocurrency transactions or wallet integrations are advised to monitor for connections to this domain and investigate any interactions as potential security incidents. No contradictory evidence, such as a clean scan or legitimate use case, has been observed in the available data.