xmeairdrop[.]pages[.]dev

This domain, xmeairdrop.pages.dev, is currently under investigation for brand impersonation specifically targeting users with a fake airdrop scheme. The page displays the title 'XME,' suggesting an attempt to mimic legitimate cryptocurrency or token distribution events associated with the XME brand. Analysis indicates the domain remains active and accessible, posing a potential risk to individuals seeking participation in airdrop campaigns. Infrastructure analysis reveals the domain was registered on March 31, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, which is geolocated to Canada and associated with Cloudflare’s network. Despite its recent creation, the domain has already been flagged on one security blocklist, though it has not yet been detected as malicious by any of the 95 vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common provider for legitimate and malicious domains alike. Notably, the domain is hosted on Cloudflare Pages, a platform frequently exploited for low-cost, high-availability phishing and scam deployments due to its ease of use and free tier. Current evidence suggests this domain is part of an active campaign to deceive users into interacting with fraudulent airdrop claims, likely leading to credential harvesting, wallet drainers, or other forms of cryptocurrency theft. Users are strongly advised to avoid engaging with the site, particularly if prompted to connect wallets, input seed phrases, or download software. Organizations should consider preemptive blocking of the domain and its resolving IP address within network security controls. Monitoring for additional detections on threat intelligence platforms is recommended, as the domain’s low detection rate may change as further analysis is conducted. Individuals who have interacted with the site should immediately revoke any connected wallet permissions and audit their accounts for unauthorized transactions.