claim-percochaos[.]pages[.]dev

This domain, claim-percochaos.pages.dev, is identified as a high-risk brand impersonation threat designed to deceive users through a fraudulent airdrop scheme. Analysis indicates the site mimics legitimate cryptocurrency airdrop promotions, likely aiming to harvest wallet credentials or deploy a crypto drainer script. The page title, 'PercoChaos | Airdrop,' reinforces the pretext of an exclusive token distribution, a common tactic in crypto-related scams.

Technical indicators confirm the domain's malicious nature. It was registered on May 25, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.46.253. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let's Encrypt (serial number E8), a legitimate provider often abused by threat actors. The domain appears on four security blocklists, and multiple transaction security tools have already blocked it due to confirmed fraudulent activity.

As of the latest assessment, claim-percochaos.pages.dev remains active, though mitigated by widespread blocking. Users encountering this domain should avoid interaction, particularly wallet connections or token claims. Organizations should update blocklists to include this domain and its associated IP. Despite current defenses, the infrastructure remains operational, posing a residual risk to unprotected users or those bypassing security controls.