defilamaa-airdrop-directory[.]pages[.]dev

This domain, defilamaa-airdrop-directory.pages.dev, was observed delivering a brand‑impersonation campaign targeting MetaMask users. The site returned HTTP 403, indicating the server refused the request, yet the page title “DefiLlama ® Airdrop — Wallet, Login, and Exchange Guide” was harvested from the response headers, suggesting the content was intended to lure victims into a wallet or seed phishing workflow. The domain was created on 21 February 2026 and is registered through Cloudflare, Inc., using the nameservers opal.ns.cloudflare.com and kenneth.ns.cloudflare.com. DNS resolution points to 172.66.44.131, an address owned by AS13335 Cloudflare, Inc., located in the United States. The SSL certificate is issued by Google Trust Services under the WE1 leaf, confirming a valid TLS connection despite the malicious intent.

Four of ninety‑three VirusTotal scanners flagged the host as malicious, and Gridinsoft assigned a trust score of 0 / 100, reinforcing the high confidence of compromise. The domain appears on a single external blocklist and is listed by Google Safe Browsing as a social‑engineering threat. PhishDestroy has already taken the site offline, and the current status is reported as offline. The infrastructure employs HSTS, HTTP/3, and Cloudflare‑provided security headers, which may obscure traffic analysis. The campaign uses the publicly available “Airdrop Scam” phishing kit, and the stated scam type is wallet/seed phishing.

The impersonated brand is MetaMask, as indicated in the intelligence, although the page title references DefiLlama, suggesting a hybrid lure. No additional content or visual analysis is available, so the exact user‑facing elements remain unknown. Defenders should block the domain and its associated IP address at the perimeter, update URL filtering to include the observed page title and known kit signatures, and monitor for similar sub‑domains registered under the same Cloudflare account.