eth-rebate[.]pages[.]dev

This domain, eth-rebate.pages.dev, is actively engaged in brand impersonation targeting cryptocurrency users through a fraudulent airdrop scheme. The page title, '2025/2026 Phase 1 ETH Community Airdrop,' explicitly mimics legitimate Ethereum community initiatives, attempting to deceive users into interacting with malicious smart contracts or disclosing wallet credentials. No direct evidence of a crypto drainer kit has been observed, though the infrastructure aligns with common airdrop scam patterns designed to exfiltrate assets or harvest sensitive data. Analysis indicates the domain was registered through Cloudflare Pages on May 6, 2026, and currently resolves to the IP address 188.114.96.3, hosted under Cloudflare, Inc. in Canada. Detection metrics reveal minimal exposure at present: the domain appears on only one security blocklist, and VirusTotal reports a 0/95 detection rate across its scanning engines. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but does not mitigate the underlying fraudulent intent. No entries have been recorded in Google Safe Browsing databases as of this assessment. The domain remains operational, posing an ongoing risk to users unaware of the impersonation tactic. Response actions have been limited to partial blocklisting, with no takedown or sinkholing observed. The low detection rate suggests the campaign may still be in an early or evasive phase, potentially targeting niche communities. Users are advised to verify airdrop legitimacy through official Ethereum channels and employ wallet isolation when interacting with unverified smart contracts. Continuous monitoring of this infrastructure is recommended to assess evolving threats.