twtts-rwrds[.]pages[.]dev

Analysis of the domain twtts-rwrds.pages.dev indicates a credential‑harvesting infrastructure targeting the Ethereum community through a fabricated airdrop scheme. The domain was registered on October 10, 2025 via Cloudflare, Inc., and its authoritative nameservers are nitin.ns.cloudflare.com and rayne.ns.cloudflare.com. The site resolves to the IPv6 address 2606:4700:310c::ac42:2cfe, which belongs to AS13335 owned by Cloudflare and is geolocated in the United States. A single security blocklist currently lists the domain, and PhishDestroy has taken the site offline.

The web server returns HTTP 403, and the page title observed during the brief scan is "Monad Faucet Website Clone," consistent with the reported scam type of a fake airdrop. Detected technologies include HTTP/3, HSTS, and Cloudflare’s edge services, while the SSL certificate is issued by Google Trust Services under the WE1 program, confirming a valid TLS handshake despite the malicious intent. The Gridinsoft trust score is 0 out of 100, reflecting extreme suspicion. VirusTotal analysis shows that 13 of 95 scanning engines flag the domain as malicious, reinforcing the threat assessment.

The infrastructure appears to be a single‑purpose operation delivering a counterfeit Ethereum faucet page, likely intended to harvest private keys or wallet credentials. No additional subdomains or related infrastructure have been observed, leaving the broader campaign scope uncertain. Defenders should block the domain at network perimeters, add the IPv6 address to threat‑intel feeds, and monitor for any resurgence of the site or associated indicators. Continuous re‑inspection of Cloudflare‑hosted domains targeting crypto brands is advised, as the low trust score and vendor detections suggest a high likelihood of further phishing attempts using similar techniques.