airdrop-rewards[.]pages[.]dev

Analysis of airdrop-rewards.pages.dev shows that the domain was registered on June 01, 2026 via Cloudflare Pages and resolves to the IPv4 address 188.114.96.3. The site is currently classified as a crypto drainer, with a high risk rating and an active status. Independent scanning on VirusTotal returned 14 positive detections out of 91 submitted security engines, indicating that multiple antivirus and URL‑reputation products have identified malicious behavior associated with the domain. The domain also appears on four external blocklists, and it has been explicitly blocked by commercial protection services including PhishDestroy, MetaMask, ScamSniffer, and SEAL.

These overlapping signals suggest a concerted effort to distribute cryptocurrency‑draining payloads or lure victims into authorizing malicious transactions. The infrastructure choice of Cloudflare Pages provides legitimate‑looking hosting while concealing the true origin of the malicious content, and the public IP address 188.114.96.3 is shared among other abuse reports, which complicates attribution. No additional evidence such as SSL certificate details, HTTP response codes, or page titles is presently available, limiting the depth of fingerprinting.

Defenders should add the domain and its resolved IP to deny‑list rules, monitor for any outbound connections to the address, and enforce multi‑factor authentication and transaction‑confirmation prompts for wallet‑related activities. Continuous re‑inspection of the domain on VirusTotal and blocklist feeds is recommended, as the threat actor may alter hosting or deploy new tactics. Organizations that handle cryptocurrency transactions should treat any request originating from this domain as malicious and block it at the network perimeter.