blum-airdrop-tonconnect[.]pages[.]dev

PhishDestroy identifies blum-airdrop-tonconnect.pages.dev as a brand impersonation phishing domain specifically targeting the Blum Airdrop brand. The domain is currently offline but remains under investigation due to its deceptive nature. This threat is classified as a crypto airdrop scam, designed to lure victims into connecting their wallets or providing sensitive information under the guise of a legitimate token distribution.

The domain was registered on April 06, 2026, through Cloudflare, Inc., and resolves to IP address 188.114.97.3. It has an SSL certificate issued by Google Trust Services (WE1) and appears on one security blocklist. Despite being flagged by blocklists, VirusTotal shows 0 out of 95 vendors detecting it as malicious, indicating that many security tools have not yet identified this threat. The page title was "Blum AirDrop," which closely mimics the legitimate Blum project to deceive users.

Given that the domain is currently offline, the immediate risk to users is reduced, but PhishDestroy recommends remaining vigilant. Users who may have interacted with this domain should revoke any permissions granted and monitor their crypto wallets for unauthorized activity. Always verify official airdrop announcements through trusted channels and avoid connecting wallets to unknown sites. PhishDestroy continues to monitor this domain for any changes in status or activity.