mars-airdropclaim[.]pages[.]dev

On July 24, 2026, analysis of the domain mars-airdropclaim.pages.dev identified infrastructure consistent with a fake‑airdrop crypto drainer campaign. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.47.80, which belongs to AS13335 operated by Cloudflare in the United States. No TLS certificate is presented, indicating the site was served over plain HTTP before being taken offline. The page title returned by the server is “DappsTools”, a name that does not correspond to a known legitimate service and likely serves to lend credibility to the malicious offering.

VirusTotal records show that one out of ninety‑three scanning engines flagged the domain, and the domain appears on a single external blocklist. In addition, the PhishDestroy blocklist explicitly lists the domain as blocked. The site’s current HTTP status is offline, confirming that the malicious content has been removed or the operators have ceased activity. Because the domain’s content was not captured before takedown, the exact mechanisms used to drain cryptocurrency wallets remain unverified; however, the classification as a fake airdrop aligns with known social‑engineering tactics that lure victims into submitting private keys or signing malicious transactions.

Defenders should add the domain and its hosting IP to network‑level deny lists, monitor for re‑registration of the same name or similar sub‑domains, and enforce strict validation of any unsolicited airdrop claims targeting crypto users. Continuous telemetry on Cloudflare‑hosted IP ranges can help detect rapid redeployment of similar campaigns. Until further forensic evidence becomes available, the domain should be treated as an elevated‑risk indicator within threat‑intel feeds.