airdrop-drai[.]pages[.]dev

This domain is flagged as a high-risk crypto drainer infrastructure impersonating the Across protocol. Analysis indicates the threat type is brand impersonation with embedded wallet-draining functionality, designed to siphon cryptocurrency assets from victims under the guise of a legitimate airdrop event. Infrastructure analysis reveals the domain airdrop-drai.pages.dev was created on August 10, 2025, and currently resolves to IP address 172.66.47.113, hosted on Cloudflare's network (AS13335). The domain is registered through Cloudflare, Inc., and presents a page titled Real-World Rally Airdrop. Security vendor detections show 2 out of 95 engines on VirusTotal flagging the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), and the IP geolocation is mapped to the United States. Mitigation requires immediate blocking of the domain and IP at network perimeter controls. Users should be alerted to verify airdrop legitimacy through official Across protocol channels only, as this infrastructure employs social engineering tactics to prompt wallet connections. Organizations should monitor for connections to 172.66.47.113 and review transaction logs for unauthorized cryptocurrency transfers linked to this campaign. Security teams are advised to correlate this indicator with other Across-themed phishing domains using the seed identifier 9e21de for broader threat hunting.