rwaairdrop[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation site specifically targeting users of the Across Protocol through a fraudulent airdrop campaign. The site, titled 'Real-World Rally Airdrop,' mimics legitimate token distribution events to deceive victims into disclosing wallet credentials or transferring assets under false pretenses. Analysis indicates the threat type aligns with cryptocurrency scams, a category known for financial theft and credential harvesting in decentralized finance ecosystems. Infrastructure analysis reveals the domain rwaairdrop.pages.dev was registered on August 07, 2025, through Cloudflare, Inc., and resolves to the IP address 104.21.64.1, geolocated to the United States under AS13335. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s infrastructure. Detection metrics show the domain is flagged by 1 of 95 security vendors on VirusTotal and appears on one security blocklist, indicating limited but present awareness of its malicious nature. The domain remains active as of the latest assessment, with no takedown or sinkholing observed. Mitigation requires immediate action from both end users and security teams. Users should avoid interacting with the domain, particularly any prompts to connect wallets or input seed phrases. Security teams are advised to add the domain rwaairdrop.pages.dev and its resolving IP 104.21.64.1 to deny lists, while monitoring for related infrastructure registered through Cloudflare or other content delivery networks. Organizations should also alert their user base to the specific threat of fake airdrops impersonating Across Protocol, emphasizing the risk of credential theft and financial loss. Proactive monitoring of newly registered domains containing 'airdrop' or protocol names is recommended to detect similar campaigns early.