airdrophunter-8nc[.]pages[.]dev

This domain, airdrophunter-8nc.pages.dev, is flagged as an active phishing infrastructure specifically targeting cryptocurrency users through airdrop scam impersonation. Analysis indicates the site mimics legitimate airdrop platforms to deceive victims into disclosing wallet credentials or transferring funds under false pretenses. The domain remains operational as of the latest verification, posing a high-risk threat to individuals engaging with cryptocurrency promotions. Infrastructure analysis reveals the domain was registered via Cloudflare Pages on September 8, 2024, and resolves to the IP address 188.114.96.3. Security vendor assessments show 3 of 95 engines on VirusTotal have flagged the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and fraudulent deployments. The domain appears on one security blocklist, and its page title, 'Airdrop Hunter,' aligns with typical scam terminology used to lure targets. No legitimate association with cryptocurrency projects or platforms has been identified. Current status confirms the domain is still active, continuing to host deceptive content. Users are advised to block all connections to 188.114.96.3 and airdrophunter-8nc.pages.dev at the network level. Cryptocurrency wallet applications should be configured to reject transactions or authentication requests originating from this domain. Security teams are recommended to update detection rules to include this domain and its associated IP in threat intelligence feeds. Individuals who may have interacted with the site should revoke any connected wallet permissions and monitor accounts for unauthorized activity.