lagrange-airdrop-claim-faq[.]pages[.]dev

Analysis on lagrange-airdrop-claim-faq.pages.dev shows an active crypto‑drainer campaign targeting users with a fake airdrop narrative. The domain was created on March 28, 2026 and is hosted behind Cloudflare’s infrastructure, using the nameservers dom.ns.cloudflare.com and naomi.ns.cloudflare.com. DNS resolution points to the IP address 172.66.44.73, which belongs to Cloudflare’s network. Registration information lists Cloudflare, Inc. as the registrar, confirming the use of a reputable DNS provider to obscure the true operator.

VirusTotal has recorded three detections out of ninety‑one security vendors, indicating that a minority of scanners have flagged the domain as malicious. The site is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. The scam type is identified as a “Fake Airdrop,” consistent with a typical crypto‑drainer approach that lures victims into disclosing private keys or sending funds. No additional intelligence such as SSL certificate details, HTTP response codes, Safe Browsing status, or threat‑intel feed identifiers (OTX, etc.) is currently available for this domain.

Uncertainty remains regarding the exact content served, the presence of any credential‑harvesting forms, and the extent of the campaign’s distribution. Defenders should add the domain and its associated IP to network deny lists, enforce DNS filtering that includes the observed blocklist entry, and monitor outbound traffic for connections to Cloudflare‑hosted endpoints matching the resolver IP. Continuous re‑scanning with multi‑vendor platforms is advised to capture any future classification changes, and incident response teams should treat any user‑initiated interactions with the domain as compromised, prompting key rotation and transaction verification.