x-eligibility-checker[.]pages[.]dev

The domain x-eligibility-checker.pages.dev is currently active and classified as a high-risk brand impersonation threat specifically targeting cryptocurrency users through an airdrop scam. Analysis confirms this domain mimics the legitimate XRPFi platform, presenting itself with the page title 'XRPFi Airdrop' to deceive victims into participating in fraudulent token distributions. The campaign appears designed to harvest wallet credentials or distribute malicious smart contracts under the guise of a legitimate cryptocurrency giveaway. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on May 11, 2026, though this creation date may reflect automated registrar defaults rather than actual deployment. The domain resolves to the IP address 188.114.96.3, which is associated with Cloudflare's content delivery network. Detection metrics show the domain is flagged by 12 of 95 security vendors on VirusTotal, while appearing on three independent security blocklists. The SSL certificate, issued by Let's Encrypt with serial number E7, provides basic encryption but does not validate the legitimacy of the underlying operation. The combination of brand impersonation, cryptocurrency targeting, and low detection thresholds indicates a sophisticated but low-effort campaign. Current status remains active, with no evidence of takedown or mitigation at the time of analysis. Users are strongly advised to avoid interacting with this domain or any associated links. Cryptocurrency holders should verify airdrop legitimacy through official project channels only, and never connect wallets to unverified third-party sites. Security teams should update blocklists to include this domain and its resolving IP address. The use of Cloudflare infrastructure suggests the operators may rapidly rotate domains, necessitating continuous monitoring of similar patterns in cryptocurrency-related phishing campaigns.