airdrop-c5d[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically designed to execute airdrop scams. Analysis indicates the site mimics legitimate cryptocurrency airdrop promotions, likely targeting users of the Audius platform based on the page title 'Airdrop 2 Artists | Audius.' The fraudulent scheme aims to deceive victims into connecting wallets or divulging private keys, enabling unauthorized asset transfers. Infrastructure analysis reveals the domain was registered on February 05, 2025, through Cloudflare, Inc., a registrar frequently exploited for malicious campaigns due to its anonymity features. The domain resolves to IP address 172.66.46.223, hosted on AS13335 (Cloudflare, Inc.) in the United States. Detection metrics show minimal coverage, with only 1 of 95 security vendors flagging the domain on VirusTotal. The site appears on a single security blocklist and is actively blocked by at least one threat intelligence feed. Google Safe Browsing has classified the domain as phishing, and the SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted sites. Mitigation requires immediate action from security teams and end users. Network administrators should block the domain and its resolving IP (172.66.46.223) at the perimeter to prevent access. Cryptocurrency users should be educated to verify airdrop legitimacy through official project channels and avoid connecting wallets to unverified platforms. Wallet providers are advised to monitor for connections originating from this domain and implement transaction warnings for interactions linked to known scam infrastructure. Given the domain's recent registration and active status, continuous monitoring is recommended to track potential shifts in hosting or additional impersonation targets.