airdrop-t3rn[.]pages[.]dev

This domain, airdrop-t3rn.pages.dev, presents an elevated-risk brand impersonation threat targeting users of the 1inch decentralized exchange platform. Analysis indicates the site masquerades as an official token claim portal under the guise of a 'BRN to TRN Claim,' a tactic commonly employed to deceive users into connecting cryptocurrency wallets. Once connected, the site likely deploys malicious smart contracts or scripts designed to drain assets from victims' wallets, a technique known as a crypto drainer. The page title and domain structure suggest a targeted campaign exploiting recent token migration or airdrop announcements associated with 1inch, increasing the likelihood of user engagement under false pretenses.

Technical indicators confirm the malicious nature of this domain. The domain was registered on July 18, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.136, hosted on infrastructure belonging to AS13335 (Cloudflare, Inc.) in the United States. VirusTotal detection metrics reveal that 10 out of 95 security vendors flag the domain as malicious, a significant ratio for a newly registered domain. Additionally, the domain appears on two security blocklists, further corroborating its classification as a threat. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as legitimate certificates are frequently abused in phishing campaigns to lend an air of authenticity to malicious sites.

Users who visited airdrop-t3rn.pages.dev and connected a wallet or entered credentials should take immediate action to mitigate potential losses. First, disconnect the wallet from all suspicious sites using the wallet interface or a trusted revoke tool. Next, transfer all assets to a new, secure wallet and revoke any unauthorized smart contract approvals associated with the compromised wallet. Monitor the original wallet for unusual activity and consider reporting the incident to relevant blockchain security teams for further analysis. Users are advised to verify the authenticity of any token claim or airdrop portal by cross-referencing official announcements from the legitimate 1inch platform or its verified communication channels.