claimmetaairdrop[.]pages[.]dev

The domain claimmetaairdrop.pages.dev is currently active and hosts a page titled “MetaMask Portfolio”, indicating a brand‑impersonation campaign targeting MetaMask users with a fake airdrop lure. The site is deployed on Cloudflare Pages and resolves to IP address 172.66.47.85, which is associated with Cloudflare, Inc. in Canada. TLS is provided by Google Trust Services under the WE1 certificate, and the site enforces HSTS while serving content over HTTP/3. Detected third‑party components include jsDelivr, cdnjs, crypto‑js, and Cloudflare’s edge network. VirusTotal records show that 16 of 91 security vendors have flagged the domain, and Gridinsoft assigns it a trust score of 0 out of 100. The domain appears on four public blocklists and is explicitly blocked by PhishDestroy, MetaMask, SEAL, and ScamSniffer. The page returns HTTP 200 responses, and the domain was created on 22 January 2025. While the content has not been manually inspected, the convergence of brand‑specific page title, fake airdrop claim, and multiple vendor detections indicates a high‑risk phishing operation. Defenders should block the domain at network perimeter, enforce URL filtering, monitor for related indicators such as the IP address and Cloudflare Pages infrastructure, and alert users about the deceptive MetaMask airdrop narrative.