flamingo-finance[.]pages[.]dev

This domain, flamingo-finance.pages.dev, is actively hosting a high-risk phishing operation impersonating a multichain airdrop platform. Registered on April 24, 2026, through Cloudflare, Inc., the site resolves to the IP address 188.114.97.3 and presents a page titled 'Aidrops on Flamingo, The Exclusive Multichain Airdrop.' Analysis indicates the use of a known airdrop-themed phishing kit, with detected technologies including Unpkg, SweetAlert2, jsDelivr, HSTS, crypto-js, cdnjs, and Cloudflare infrastructure supporting HTTP/3. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious sites, offering no inherent indication of trustworthiness. The domain holds a Scamadviser trust score of 11/100 and a Gridinsoft trust score of 0/100, reflecting strong suspicion of fraudulent activity. It appears on three security blocklists and is currently blocked by ScamSniffer, PhishDestroy, and Enkrypt. While two of 95 security vendors on VirusTotal flag the domain, this limited detection does not conclusively confirm malicious intent but aligns with broader indicators of compromise. Defenders should treat this domain as active phishing infrastructure. The exact content and mechanics of the scam remain unanalyzed, but the combination of airdrop-themed branding, low trust scores, and blocklist inclusion warrants immediate mitigation. Network-level blocking or monitoring of connections to 188.114.97.3 and flamingo-finance.pages.dev is recommended. Further investigation into associated wallet addresses or redirect chains may reveal additional compromised endpoints.