lista-dao-airdrop[.]pages[.]dev

PhishDestroy identifies lista-dao-airdrop.pages.dev as a live brand impersonation landing page targeting cryptocurrency users with a fraudulent airdrop scheme. The domain is configured to mirror the visual identity of a legitimate airdrop campaign in an attempt to harvest private keys or seed phrases from unwitting visitors. No drainer kit artifacts are observed in passive DNS or sandbox detonation at this time; the threat remains focused on social engineering and credential harvesting. Future updates will include YARA matches once additional samples are captured. Domain lista-dao-airdrop.pages.dev is hosted on 188.114.96.3 and resolves through Cloudflare, Inc. registrar services. Google’s Safe Browsing currently lists the domain as clean, and VirusTotal shows 0 engines flagging the URL out of 95 scanners. The SSL certificate is issued by Google Trust Services, indicating basic encryption without additional vetting of site content. Registrant privacy is enforced via Cloudflare’s proxy layer, delaying WHOIS attribution. This domain remains under active investigation with a status of active and a risk rating of under_investigation. No global blocklists have been applied thus far due to the low detection score. Users should avoid interacting with this domain and report any encounters to their security teams or via PhishDestroy’s submission portal. Remaining risk centers on the possibility of the threat actor pivoting to a more aggressive drainer kit or expanding distribution through social media campaigns. Monitor updates for revisions to the VT score or GSB status.