slaimcrypcyfixy[.]pages[.]dev

Analysis of slaimcrypcyfixy.pages.dev, observed on July 23, 2026, confirms the domain is being used for a fake airdrop phishing campaign. The site returned an HTTP 403 response when accessed, indicating that the content is presently inaccessible, and its status is listed as offline. The domain was created on September 02, 2020 and is registered through Cloudflare, Inc., leveraging Cloudflare's DNS and edge services. It resolves to the IPv6 address 2606:4700:310c::ac42:2f53, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 label, confirming the use of a valid TLS chain despite the malicious intent.

Technical fingerprints show HSTS enforcement, HTTP/3 support, and continued reliance on Cloudflare's infrastructure. Reputation data indicates the domain appears on one security blocklist and has been flagged by PhishDestroy. Independent scanning on VirusTotal recorded 15 detections out of 93 security vendors, reinforcing the malicious classification. The page title reported by the scanner is "Home | DappsConnector," which aligns with the observed scam type of a fabricated airdrop offering. The Gridinsoft trust score of 0/100 further reflects a high confidence of malicious behavior.

While the exact phishing landing page content cannot be examined due to the 403 status, the combination of blocklist presence, vendor detections, and the fake‑airdrop narrative provides sufficient evidence for remediation. Defenders should block the domain at network perimeter, update URL filtering lists, and monitor for any future re‑hosting of the same infrastructure. Incident response teams should also consider correlating traffic to the associated IPv6 address and Cloudflare nameservers (adi.ns.cloudflare.com, alexia.ns.cloudflare.com, corey.ns.cloudflare.com, karl.ns.cloudflare.com) to identify related campaigns.