buy-airdrop[.]pages[.]dev

Analysis indicates that buy-airdrop.pages.dev is an active domain currently under investigation for hosting a fake crypto airdrop scam. The domain was registered on October 30, 2025, through Cloudflare, Inc., and resolves to a Cloudflare IP address (188.114.96.3) within AS13335. Infrastructure analysis reveals the use of Cloudflare nameservers (emerie.ns.cloudflare.com and tim.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are consistent with modern web hosting but do not inherently indicate malicious intent. The page title, 'MoonPay Commerce | Sell more with crypto ⚡️,' suggests an attempt to mimic a legitimate cryptocurrency payment service, though the exact content and functionality of the site have not yet been fully analyzed. The domain has been flagged by at least one security blocklist and assigned a trust score of 0/100 by Gridinsoft, reinforcing suspicions of malicious activity. However, as of the most recent scan, no security vendors on VirusTotal have flagged the domain, though this absence does not confirm its safety. The scam type is classified as a 'fake airdrop,' a tactic commonly used to deceive users into connecting wallets or sharing credentials under the pretense of receiving free cryptocurrency. Defenders should treat this domain as suspicious and monitor for further indicators of compromise. Given its active status and association with known phishing infrastructure, organizations are advised to block or restrict access to buy-airdrop.pages.dev until additional analysis confirms its legitimacy or malicious nature.